Repository navigation
Resolve 3 open Scorecard alerts (#63 Pinned-Deps, #72 SAST, #44 Maintained) #40
Description
Refs hyperpolymath/hypatia#260 (root-cause + anti-recurrence). Do not auto-close.
- chore(ci): add dormant push-email notification workflow #72 SAST — codeql.yml matrix was
javascript-typescript; repo is Ada/Scheme/Shell so CodeQL recorded 0 results → "0/7 commits checked". Fix: matrix →language: actions(always scannable, runs every commit). (this PR) - ci(scorecard): add job-level permissions for reusable workflow #63 Pinned-Dependencies —
generator-generic-ossf-slsa3-publish.yml:68usesslsa-framework/slsa-github-generator/...@v2.1.0. SHA-pinning the SLSA generator is harmful (it self-verifiesgithub.ref; SHA-ref → invalid provenance). Accepted false-positive → dismissed with rationale. - chore: Item 10 — migrate .scm metadata family → .a2ml (Track A, faithful) #44 Maintained — 0 commits/issues in 90d. Scorecard states no remediation needed; informational activity signal → dismissed with rationale (and resolved by activity).
Activity
fix(ci): point CodeQL at `actions` so SAST runs every commit (#72) (#41)
hyperpolymath commentedon May 17, 2026
Jointly closed by explicit maintainer agreement (2026-05-17). #72 SAST fixed via modshells#41 (CodeQL matrix →
actions; auto-clears on next Scorecard run). #63 (Pinned-Deps/SLSA) and #44 (Maintained) are no longer open code-scanning alerts. Validated live by hyperpolymath/hypatiaScorecardReconciler(2026-05-17):found=1(only #72, action=fix),recurrence_defects=[], decision recorded to the offline registry. Refs hyperpolymath/hypatia#260.