From 932a08ed9376737b08f110ac012acbd0f8bc5972 Mon Sep 17 00:00:00 2001 From: MerlinH Date: Fri, 26 Jun 2026 15:22:11 +0000 Subject: [PATCH] ci: remove openssf scorecard --- .github/workflows/scorecard.yml | 33 ------------------- README.md | 1 - .../operations/release-automation.md | 12 ++----- .../routes/areas/release-automation.md | 2 +- 4 files changed, 3 insertions(+), 45 deletions(-) delete mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml deleted file mode 100644 index 9f45224..0000000 --- a/.github/workflows/scorecard.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: OpenSSF Scorecard - -on: - branch_protection_rule: - push: - branches: - - main - pull_request: - schedule: - - cron: '18 4 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - scorecard: - name: Scorecard - runs-on: ubuntu-latest - timeout-minutes: 20 - permissions: - contents: read - id-token: write - steps: - - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - with: - persist-credentials: false - - name: OSSF Scorecard action - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 - with: - results_file: results.json - results_format: json - publish_results: ${{ github.event_name != 'pull_request' }} diff --git a/README.md b/README.md index 9a01764..a490f13 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,6 @@ [![npm version](https://img.shields.io/npm/v/truthmark?color=cb3837&label=npm)](https://www.npmjs.com/package/truthmark) [![CI](https://github.com/merlinhu1/truthmark/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/merlinhu1/truthmark/actions/workflows/ci.yml) -[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/merlinhu1/truthmark/badge)](https://scorecard.dev/viewer/?uri=github.com/merlinhu1/truthmark) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE) [![Node.js >=24](https://img.shields.io/badge/node-%3E%3D24-339933?logo=node.js&logoColor=white)](package.json) diff --git a/docs/truthmark/engineering/operations/release-automation.md b/docs/truthmark/engineering/operations/release-automation.md index 130f541..1d277aa 100644 --- a/docs/truthmark/engineering/operations/release-automation.md +++ b/docs/truthmark/engineering/operations/release-automation.md @@ -26,10 +26,6 @@ CodeQL is handled by GitHub's default setup for this repository. Checked-in advanced CodeQL workflow configuration is intentionally absent while default setup is enabled. -OpenSSF Scorecard runs as a repository-readiness check on mainline, pull request, scheduled, manual, and branch-protection-rule events. - -The Scorecard workflow does not upload SARIF and does not request `security-events: write`; it publishes Scorecard results through OIDC on non-pull-request events. - Dependency-update monitoring is managed by existing GitHub repository configuration outside this PR's checked-in workflow changes. ## Operational Surface @@ -44,7 +40,7 @@ Automation runs in GitHub Actions. There is no Truthmark daemon or persistent ru ## Configuration -- GitHub workflow YAML files define CI, release, Pages deployment, and Scorecard triggers. +- GitHub workflow YAML files define CI, release, and Pages deployment triggers. - Checked-in workflow actions are pinned to full commit SHAs, with inline comments preserving the upstream action version tag used to choose each SHA. - GitHub repository settings own CodeQL default setup and existing dependency-update monitoring. - `src/templates/github-action.ts` owns generated GitHub Action template behavior. @@ -55,8 +51,6 @@ Permissions are owned by the checked-in GitHub workflow and action template defi This doc does not add permissions beyond those source files. -The Scorecard workflow keeps workflow-level token permissions read-only and grants `id-token: write` only to the Scorecard job. - ## Deployment And Rollback - Workflow changes deploy when repository workflow files are committed to the target branch. @@ -77,9 +71,8 @@ The Scorecard workflow keeps workflow-level token permissions read-only and gran - Decision (2026-06-14): Release automation truth is engineering/operational truth because it describes current repository mechanics. - Decision (2026-06-26): GitHub Pages deploys only the committed static introduction site under `site/**`. - The site is a presentation artifact; Markdown truth docs remain canonical. -- Decision (2026-06-26): Project-readiness checks use standard GitHub-native scanners before custom readiness badges or claims. +- Decision (2026-06-26): Repository-readiness checks stay on existing GitHub-native configuration unless a checked-in workflow is explicitly needed. - CodeQL default setup covers code scanning without a checked-in advanced workflow. - - OpenSSF Scorecard covers external repository-health/security heuristics. - Existing GitHub repository configuration covers dependency-update monitoring. ## Rationale @@ -100,7 +93,6 @@ Update when CI triggers, release prerequisites, publish steps, Pages deployment - ../../../../.github/workflows/ci.yml - ../../../../.github/workflows/pages.yml - ../../../../src/templates/github-action.ts -- ../../../../.github/workflows/scorecard.yml - ../../../../site/index.html - `.github/workflows/**` - `site/**` diff --git a/docs/truthmark/routes/areas/release-automation.md b/docs/truthmark/routes/areas/release-automation.md index a5731fd..7b88279 100644 --- a/docs/truthmark/routes/areas/release-automation.md +++ b/docs/truthmark/routes/areas/release-automation.md @@ -27,7 +27,7 @@ Update truth when: - CI verification steps or triggers change - release publishing prerequisites or publish steps change -- CodeQL, Scorecard, or other checked-in repository-readiness automation changes +- CodeQL or other checked-in repository-readiness automation changes - GitHub Pages deployment or static introduction site behavior changes - GitHub Action examples or action template rendering changes