chore(ci): make Scorecard periodic, not per-push - #94
Merged
Merged
Conversation
Scorecard measures the REPOSITORY's supply-chain posture, not the change under
review. The estate's signal-discipline standard puts repository-level
measurements in the PERIODIC tier: on a schedule against the default branch,
feeding one dashboard — not on every event.
Measured across 303 scorecard workflows before this sweep:
199 push, schedule, workflow_dispatch
93 branch_protection_rule, schedule, push
1 push, pull_request, schedule, workflow_dispatch
1 schedule, workflow_dispatch <- the target shape
So roughly 292 repositories ran a full posture scan on EVERY push to the
default branch. That is pure cost: a supply-chain score cannot meaningfully
change between two consecutive merges, and it never gated anything.
WHAT IS DELIBERATELY KEPT:
schedule the point of the tier
workflow_dispatch manual re-run when one is actually wanted
branch_protection_rule event-driven re-measurement of precisely what
Scorecard scores. It fires on a settings change, not
per pull request, so it does not violate the PERIODIC
rule — and it keeps the score honest after exactly
the change most likely to alter it.
Only `push` and `pull_request` are removed. `pull_request` existed in one
repository and was the genuine violation; `push` was the cost.
Related, and the reason this matters beyond minutes: Scorecard was ALSO
required as a `code_scanning` tool in 78 repositories at alertsThreshold=all,
while producing code-scanning results in essentially none — because it does not
emit per-commit SARIF. That made it an estate-wide merge blocker asking to do
something it does not do. Those requirements have been removed separately.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedUpdates the OpenSSF Scorecard CI workflow to run on a periodic schedule instead of every push and pull request. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 4 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
hyperpolymath
added a commit
that referenced
this pull request
Sep 22, 2026
…estate-wide startup_failure) (#119) ## Summary Estate-wide incident: `github/codeql-action` **v4.38.1** fails GitHub workflow **startup** on every repo that took it — CodeQL/Hypatia runs die with `startup_failure`, zero jobs dispatched, no error text in any API surface. The evidence chain (full detail: **nexia-list#100**): | repo | ref | status | |---|---|---| | nexia-list | `@v4.38.1` tag (via dependabot #94) | 🔴 startup_failure → fixed by rollback #100 (merged) | | hypatia | `@1c5b675` (4.38.1 SHA) | 🔴 | | vexometer | `@v4.38.1` | 🔴 (since Sep-21) | | rsr-template-repo | `@1c5b675` | 🔴 | | affinescript / boj-server / deed-ecosystem | ≤ v4.38.0 | ✅ green | The v4.38.1 tag *exists* (peels to `1c5b675`) and byte-identical workflow content runs under a fresh path — so the failure is the **version value itself** at GitHub's start-validation layer, not content, permissions (probes with `security-events` start fine), or the default-setup conflict. ## Changes here - `codeql-reusable.yml`, `hypatia-scan-reusable.yml`: `codeql-action/*` re-pinned `1c5b675` (v4.38.1) → `b96794f0` (**v4.38.0** commit; wrong `# v3` comments corrected to `# v4.38.0`). - `actions.lock`: re-keyed to the v4.38.0 SHA entries (dependabot bumped the reusable pins without regenerating the lock). - `dependabot.yml`: **full hold** on `github/codeql-action` — scoped `versions:` ignores do NOT hold for this bot path (nexia-list#101 re-raised the bump in SHA form within an hour, copying the inline warning comment verbatim while swapping the SHA). ## Follow-ups Consumer rollbacks shipped in the same batch: nexia-list (merged ✅), **hypatia**, **vexometer**, **rsr-template-repo**, **metadatastician/burble** (each with the same dependabot hold). Reconsider the hold when upstream clears v4.38.1 or a newer release verifies green on one canary repo. Co-authored-by: arena-agent <arena-agent@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes the OpenSSF Scorecard workflow periodic by dropping its
push(and, in one repository,pull_request) trigger.schedule,workflow_dispatchandbranch_protection_ruleare all kept.Why. Scorecard measures the repository's supply-chain posture, not the change under review. That is the
📅 PERIODIC:tier in the estate's signal-discipline standard: on a schedule against the default branch, feeding a dashboard — not on every event. It cannot meaningfully pass or fail a diff.Measured across 303 scorecard workflows before this sweep:
So ~292 repositories ran a full posture scan on every push to the default branch. That is pure cost: the score cannot meaningfully change between two consecutive merges.
Deliberately kept:
branch_protection_rule. It fires on a settings change — not per pull request — so it does not violate the PERIODIC rule, and it re-measures precisely what Scorecard scores after exactly the change most likely to alter it.🤖 Generated with Claude Code