ci(scorecard): stop filing repository grades as code-scanning alerts

[luckyPipewrench]

What changed

The OpenSSF Scorecard job no longer uploads its results to code scanning. It still runs, still publishes to the public Scorecard API that backs the badge and viewer, and still keeps the raw SARIF as a build artifact. The job's security-events: write permission is dropped because nothing in it writes alerts now.

Why

Scorecard grades repository practice: whether actions are pinned to digests, whether branch protection is on, what share of pull requests carried an approving review. Code scanning is the surface for defects in this repository's code. Uploading the grade into that surface files each check as a dismissible alert carrying a severity, which is a different claim from the one Scorecard makes.

Those alerts also do not stay dismissed. GitHub matches results across uploads by rule and fingerprint, and a result whose identity shifts arrives as a new alert that an earlier dismissal does not cover. Two alerts in this repository reported the same finding at the same file and line on consecutive days. One rule accumulated 25 separate alert numbers over five months, and a false positive was dismissed under four different numbers. The result was a standing queue of security-labelled items that no code change could close, which trains a reader to clear the queue without reading it.

What this does not do

It does not hide the grade. publish_results continues to send results to the public OpenSSF Scorecard API, so anyone can read this repository's score and its per-check detail without asking. The artifact keeps the raw SARIF for the run.

It also does not claim that code scanning now holds only genuine findings. Scorecard's own vulnerability check reports advisories that remain worth reading; they are read from the Scorecard result rather than from an alert list. Anyone auditing this repository should look at both.

CodeQL is unaffected. It uploads its own SARIF from a separate job with its own permission, and it remains a required check.

Summary by CodeRabbit

• Security
  • Updated security scorecard reporting while continuing to publish results through the OpenSSF API.
  • Scorecard results remain available as downloadable workflow artifacts.

[coderabbitai]

Warning

Review limit reached

@luckyPipewrench, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 83 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fef3985d-2e0f-4998-93e5-7ea9b605ac4f

📥 Commits

Reviewing files that changed from the base of the PR and between e14da49 and d0de0c8.

📒 Files selected for processing (1)

• .github/workflows/scorecard.yml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 403faef9-04b2-46b7-a31b-e1a80ae2fdde

📥 Commits

Reviewing files that changed from the base of the PR and between afe6127 and e14da49.

📒 Files selected for processing (1)

• .github/workflows/scorecard.yml

---

📝 Walkthrough

Walkthrough

The Scorecard workflow removes security-events: write and the GitHub code-scanning SARIF upload. It retains OpenSSF Scorecard API publication and artifact retention.

Changes

Scorecard workflow permissions

Layer / File(s)	Summary
Restrict Scorecard result publication .github/workflows/scorecard.yml	The workflow removes security-events: write, keeps read access and id-token: write, and replaces the code-scanning upload step with explanatory comments. OpenSSF API publication and artifact retention remain enabled.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to e14da

This change stops publishing repository-practice grades as code-scanning alerts while preserving Scorecard results and artifacts; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: stopping Scorecard results from becoming code-scanning alerts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/scorecard-stop-sarif-upload

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}