External/truthmark
1
0
Fork 0
mirror of https://github.com/merlinhu1/truthmark.git synced 2026-08-25 07:53:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

ci: remove openssf scorecard

Browse Source
This commit is contained in:
MerlinH
2026-06-27 01:23:24 +10:00
parent 3c52f21d90
commit 932a08ed93
4 changed files with 3 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/scorecard.yml
-33
View File
@@ -1,33 +0,0 @@
name: OpenSSF Scorecard
on:
branch_protection_rule:
push:
branches:
- main
pull_request:
schedule:
- cron: '18 4 * * 1'
workflow_dispatch:
permissions:
contents: read
jobs:
scorecard:
name: Scorecard
runs-on: ubuntu-latest
timeout-minutes: 20
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
persist-credentials: false
- name: OSSF Scorecard action
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
with:
results_file: results.json
results_format: json
publish_results: ${{ github.event_name != 'pull_request' }}
README.md
-1
View File
@@ -4,7 +4,6 @@
[![npm version](https://img.shields.io/npm/v/truthmark?color=cb3837&label=npm)](https://www.npmjs.com/package/truthmark)
[![CI](https://github.com/merlinhu1/truthmark/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/merlinhu1/truthmark/actions/workflows/ci.yml)
[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/merlinhu1/truthmark/badge)](https://scorecard.dev/viewer/?uri=github.com/merlinhu1/truthmark)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
[![Node.js >=24](https://img.shields.io/badge/node-%3E%3D24-339933?logo=node.js&logoColor=white)](package.json)
docs/truthmark/engineering/operations/release-automation.md
+2 -10
View File
@@ -26,10 +26,6 @@ CodeQL is handled by GitHub's default setup for this repository.
Checked-in advanced CodeQL workflow configuration is intentionally absent while default setup is enabled.
OpenSSF Scorecard runs as a repository-readiness check on mainline, pull request, scheduled, manual, and branch-protection-rule events.
The Scorecard workflow does not upload SARIF and does not request `security-events: write`; it publishes Scorecard results through OIDC on non-pull-request events.
Dependency-update monitoring is managed by existing GitHub repository configuration outside this PR's checked-in workflow changes.
## Operational Surface
@@ -44,7 +40,7 @@ Automation runs in GitHub Actions. There is no Truthmark daemon or persistent ru
## Configuration
- GitHub workflow YAML files define CI, release, Pages deployment, and Scorecard triggers.
- GitHub workflow YAML files define CI, release, and Pages deployment triggers.
- Checked-in workflow actions are pinned to full commit SHAs, with inline comments preserving the upstream action version tag used to choose each SHA.
- GitHub repository settings own CodeQL default setup and existing dependency-update monitoring.
- `src/templates/github-action.ts` owns generated GitHub Action template behavior.
@@ -55,8 +51,6 @@ Permissions are owned by the checked-in GitHub workflow and action template defi
This doc does not add permissions beyond those source files.
The Scorecard workflow keeps workflow-level token permissions read-only and grants `id-token: write` only to the Scorecard job.
## Deployment And Rollback
- Workflow changes deploy when repository workflow files are committed to the target branch.
@@ -77,9 +71,8 @@ The Scorecard workflow keeps workflow-level token permissions read-only and gran
- Decision (2026-06-14): Release automation truth is engineering/operational truth because it describes current repository mechanics.
- Decision (2026-06-26): GitHub Pages deploys only the committed static introduction site under `site/**`.
- The site is a presentation artifact; Markdown truth docs remain canonical.
- Decision (2026-06-26): Project-readiness checks use standard GitHub-native scanners before custom readiness badges or claims.
- Decision (2026-06-26): Repository-readiness checks stay on existing GitHub-native configuration unless a checked-in workflow is explicitly needed.
- CodeQL default setup covers code scanning without a checked-in advanced workflow.
- OpenSSF Scorecard covers external repository-health/security heuristics.
- Existing GitHub repository configuration covers dependency-update monitoring.
## Rationale
@@ -100,7 +93,6 @@ Update when CI triggers, release prerequisites, publish steps, Pages deployment
- ../../../../.github/workflows/ci.yml
- ../../../../.github/workflows/pages.yml
- ../../../../src/templates/github-action.ts
- ../../../../.github/workflows/scorecard.yml
- ../../../../site/index.html
- `.github/workflows/**`
- `site/**`
docs/truthmark/routes/areas/release-automation.md
+1 -1
View File
@@ -27,7 +27,7 @@ Update truth when:
- CI verification steps or triggers change
- release publishing prerequisites or publish steps change
- CodeQL, Scorecard, or other checked-in repository-readiness automation changes
- CodeQL or other checked-in repository-readiness automation changes
- GitHub Pages deployment or static introduction site behavior changes
- GitHub Action examples or action template rendering changes