Skip to content

Ci/fix ossf scorecard startup - #28

Closed
hyperpolymath wants to merge 2 commits into
mainfrom
ci/fix-ossf-scorecard-startup
Closed

Ci/fix ossf scorecard startup#28
hyperpolymath wants to merge 2 commits into
mainfrom
ci/fix-ossf-scorecard-startup

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented Aug 11, 2026 •
edited by gitar-bot Bot
Loading

Copy link
Copy Markdown
Owner

Summary

Closes #

Type of change

  • 🐛 Bug fix (non-breaking change that fixes an issue)
  • ✨ New feature (non-breaking change that adds functionality)
  • 💥 Breaking change (would change existing behaviour)
  • 🕳️ Soundness fix (fixes a checker/proof false-negative)
  • 📖 Documentation
  • 🧹 Refactor / tech debt (behaviour-preserving)
  • ⚡ Performance
  • 🔧 Build / CI / tooling

How has this been verified?

Checklist

  • My commits are signed (git commit -S).
  • I ran the project's own checks/tests locally and they pass.
  • New files carry the correct SPDX-License-Identifier (code/config MPL-2.0,
    prose CC-BY-SA-4.0); I did not relicense existing files.
  • Docs are updated, and no public claim now overstates what the code does.
  • I have not introduced a soundness hole (or I have flagged where I might have).

Notes for reviewers

Summary by Gitar

  • CI / Tooling:
    • Updated OSSF Scorecard reusable workflow reference in scorecard.yml to use commit d7c22711e830e1f383846472f6e9b99debdb201e.

This will update automatically on new commits.

hyperpolymath and others added 2 commits July 7, 2026 19:21
@hyperpolymath
fix(ci): estate-wide structural CI fixes
a7d17a6 
- grant secret-scanner reusable its requested job permissions
- drop invalid timeout-minutes on reusable-call jobs
- drop hashFiles() from job-level if: expressions
Antigravity Agent
fix(ci): clear OSSF Scorecard startup_failure
943c84b 
Fixes the OSSF Scorecard workflow, which failed at startup on every run.

**Cause:** reusable-workflow caller missing `security-events: write`+`id-token: write` (reusable perms are capped by the caller), and/or an illegal `timeout-minutes` key on a `uses:` job.

**Fix:** inject caller permissions and/or drop `timeout-minutes`. Pin preserved. Verified with actionlint. Part of an estate-wide Scorecard remediation.

🤖 Generated with Antigravity
@gitar-bot

gitar-bot Bot commented Aug 11, 2026

Copy link
Copy Markdown

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

Gitar

@hyperpolymath hyperpolymath mentioned this pull request Aug 11, 2026
Merged
hyperpolymath added a commit that referenced this pull request Aug 11, 2026
@hyperpolymath @mistral-vibe
fix(ci): clear OSSF Scorecard startup_failure (#29)
54d3caa 
Update scorecard.yml: add push trigger for main/master, update SHA pin
to d7c2271

The secret-scanner.yml changes from PR #28 are outdated (already
upgraded to reusable workflows in #23).

Supersedes #28

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
@hyperpolymath

hyperpolymath commented Aug 11, 2026

Copy link
Copy Markdown
Owner Author

Closed as superseded by #29. The secret-scanner.yml changes were outdated (already upgraded to reusable workflows in #23).

@hyperpolymath
hyperpolymath deleted the ci/fix-ossf-scorecard-startup branch August 11, 2026 23:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath