chore(ci): make Scorecard periodic, not per-push - #135
Conversation
Scorecard measures the REPOSITORY's supply-chain posture, not the change under
review. The estate's signal-discipline standard puts repository-level
measurements in the PERIODIC tier: on a schedule against the default branch,
feeding one dashboard — not on every event.
Measured across 303 scorecard workflows before this sweep:
199 push, schedule, workflow_dispatch
93 branch_protection_rule, schedule, push
1 push, pull_request, schedule, workflow_dispatch
1 schedule, workflow_dispatch <- the target shape
So roughly 292 repositories ran a full posture scan on EVERY push to the
default branch. That is pure cost: a supply-chain score cannot meaningfully
change between two consecutive merges, and it never gated anything.
WHAT IS DELIBERATELY KEPT:
schedule the point of the tier
workflow_dispatch manual re-run when one is actually wanted
branch_protection_rule event-driven re-measurement of precisely what
Scorecard scores. It fires on a settings change, not
per pull request, so it does not violate the PERIODIC
rule — and it keeps the score honest after exactly
the change most likely to alter it.
Only `push` and `pull_request` are removed. `pull_request` existed in one
repository and was the genuine violation; `push` was the cost.
Related, and the reason this matters beyond minutes: Scorecard was ALSO
required as a `code_scanning` tool in 78 repositories at alertsThreshold=all,
while producing code-scanning results in essentially none — because it does not
emit per-commit SARIF. That made it an estate-wide merge blocker asking to do
something it does not do. Those requirements have been removed separately.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedUpdates the OpenSSF Scorecard workflow triggers to periodic-only by removing push and pull_request events. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 4 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
1 participant
Makes the OpenSSF Scorecard workflow periodic by dropping its
push(and, in one repository,pull_request) trigger.schedule,workflow_dispatchandbranch_protection_ruleare all kept.Why. Scorecard measures the repository's supply-chain posture, not the change under review. That is the
📅 PERIODIC:tier in the estate's signal-discipline standard: on a schedule against the default branch, feeding a dashboard — not on every event. It cannot meaningfully pass or fail a diff.Measured across 303 scorecard workflows before this sweep:
So ~292 repositories ran a full posture scan on every push to the default branch. That is pure cost: the score cannot meaningfully change between two consecutive merges.
Deliberately kept:
branch_protection_rule. It fires on a settings change — not per pull request — so it does not violate the PERIODIC rule, and it re-measures precisely what Scorecard scores after exactly the change most likely to alter it.🤖 Generated with Claude Code