Open
Conversation
Plugin Test Summary 1 files 3 suites 1s ⏱️ Results for commit 3c50812. ♻️ This comment has been updated with latest results. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if: ${{ always() && github.event_name == 'workflow_dispatch' }} | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write |
Check failure
Code scanning / Scorecard
Token-Permissions
| name: Copy internal release to public repo | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write |
Check failure
Code scanning / Scorecard
Token-Permissions
Compactc E2E Test Summary2 825 tests 2 825 ✅ 5m 49s ⏱️ Results for commit 3c50812. ♻️ This comment has been updated with latest results. |
JosephDenman
force-pushed
the
JosephDenman/fix-scorecard
branch
from
aeaa6a9 to
0d3d539
Compare
Signed-off-by: JosephDenman <joseph.denman@iohk.io>
JosephDenman
force-pushed
the
JosephDenman/fix-scorecard
branch
from
0d3d539 to
1d17956
Compare
JosephDenman
force-pushed
the
JosephDenman/fix-scorecard
branch
from
1d17956 to
3c50812
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
PR #236 (Improve README and CONTRIBUTING) has been blocked from merging because the Scorecard code scanning check fails with three findings:
These are repo-wide issues, not specific to that PR. This PR fixes them so that #236 (and future PRs) can merge cleanly.
Summary
permissions: {}everywhere, with only the minimum grants each job actually needsactions/cache,actions/setup-python) to commit SHAscompatibility-test,release-test, and several other workflows into the centralizedpublish-test-results.ymlvia artifact uploads — same pattern we already use forcompiler-extractedandbuild-vscpluginscan.ymlto use the latest version ofupload-sarif-github-action, which lets us configure which Scorecard checks run. I excludeToken-Permissionsbecause it false-positives on release workflows that legitimately needcontents: writeto create GitHub releases and push tagscargo updateandyarn upgradeto clear known vulnerabilities flagged by Scorecard's Vulnerabilities checkNotes
internal-release.yml,public-release.yml) still declarecontents: writeon their release-creation jobs. This is unavoidable — they need it to push tags and create releases. Excluding theToken-PermissionsScorecard check is the correct fix here since the permission is already scoped to the minimum (single job, manual-trigger-only workflows).jsonwebtoken(blocked by octocrab),number_prefix(unmaintained transitive dep from cargo-nextest), andserialize-javascript/diff(locked by mocha).