Add reusable OSSF Scorecard workflow - #224
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a reusable OSSF Scorecard workflow supporting sig-security#309.
Changes:
- Enables
workflow_calland documents adoption. - Filters SARIF uploads to three actionable checks.
- Adds catalog and ownership metadata.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/scorecard.yml |
Adds reuse and SARIF filtering. |
scorecard/README.md |
Documents usage and filtering. |
README.md |
Adds the workflow catalog entry. |
CONTRIBUTING.md |
Reclassifies Scorecard as shared. |
.github/workflows/README.md |
Updates workflow categories. |
.github/CODEOWNERS |
Assigns Scorecard ownership. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
trask
marked this pull request as ready for review
August 5, 2026 18:12
Pull request dashboard statusMerged · refreshed 2026-08-06 13:40 UTC Status above doesn't look right?
|
This comment was marked as low quality.
This comment was marked as low quality.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
mx-psi
approved these changes
Aug 6, 2026
79 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes the repo-internal Scorecard workflow a reusable workflow that other repositories can call, and narrows what it uploads to code scanning to
DangerousWorkflowID,PinnedDependenciesID, andTokenPermissionsID. The full Scorecard result is still published, so the badge and the publicapi.scorecard.deventry are unaffected.The filter runs in a second job because
scorecard-actionverifies the job that publishes results and rejects any step that is not auses:of an allow-listed action, so arun:step cannot sit alongside it. Rule definitions are left in the SARIF so the results that are dropped close rather than go stale.Also gives both this workflow and
zizmor.ymla static concurrency group prefix.${{ github.workflow }}resolves to the caller's name inside a reusable workflow, so a caller using the common${{ github.workflow }}-${{ github.ref }}group collides with it. Measured in a fork: the collision fails the run outright, with zero jobs and zero steps executed and no message surfaced through the checks API.zizmor.ymlis called by around 23 repositories today, none of which currently declare a concurrency group.Part of open-telemetry/sig-security#309.