From e14da4941e64fb0012478c6bcb434e19e521daf3 Mon Sep 17 00:00:00 2001 From: luckyPipewrench Date: Fri, 14 Aug 2026 12:22:33 -0400 Subject: [PATCH 1/2] ci(scorecard): stop filing repository grades as code-scanning alerts --- .github/workflows/scorecard.yml | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index d64b2a9..34285ef 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -15,7 +15,9 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - security-events: write + # No security-events: write. This job no longer uploads SARIF, so it + # needs no permission to write code-scanning alerts. id-token remains + # because publish_results signs the result for the public Scorecard API. id-token: write steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 @@ -36,7 +38,22 @@ jobs: path: results.sarif retention-days: 5 - - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4 - with: - sarif_file: results.sarif + + # Scorecard results are NOT uploaded to code scanning, deliberately. + # + # Scorecard grades repository practice: pinned dependencies, branch + # protection, what share of pull requests carried an approving review. + # Code scanning is the surface for defects in this repository's code, and + # routing a grade into it files each check as a dismissible alert with a + # severity attached. + # + # Those alerts also do not stay dismissed. GitHub matches results across + # uploads by rule and fingerprint, and a Scorecard result whose identity + # shifts arrives as a NEW alert that a previous dismissal does not cover. + # The outcome was a standing queue of security-labelled items that no code + # change could close. + # + # The results remain public and retrievable: publish_results above sends + # them to the OpenSSF Scorecard API that backs the badge and the public + # viewer, and the artifact above keeps the raw SARIF. This narrows where + # the grade is displayed. It does not withhold it. From d0de0c8587cc40a9ccf152de6fa2a77b74c401c6 Mon Sep 17 00:00:00 2001 From: luckyPipewrench Date: Fri, 14 Aug 2026 12:59:16 -0400 Subject: [PATCH 2/2] docs(scorecard): name code scanning as the destination that was dropped --- .github/workflows/scorecard.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 34285ef..1ef13b8 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -15,9 +15,11 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - # No security-events: write. This job no longer uploads SARIF, so it - # needs no permission to write code-scanning alerts. id-token remains - # because publish_results signs the result for the public Scorecard API. + # No security-events: write. This job no longer uploads SARIF to code + # scanning, so it needs no permission to write code-scanning alerts. It + # does still upload results.sarif as a build artifact below. id-token + # remains because publish_results signs the result for the public + # Scorecard API. id-token: write steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7