statecraft.
Catalog/spec-spine

202-openssf-scorecard-reports-on-main

OpenSSF Scorecard reports on main

Lifecycle approvedImplementation completeVerification unknownQualification unknown

An unmanaged `scorecard.yml` runs the OpenSSF Scorecard action on every push to `main`, weekly, and on any branch-protection change, uploads its SARIF to code scanning and publishes the result to the OpenSSF API. Every action is pinned to a commit SHA. It is a report, not a gate: no pull request waits on it and `ci-gate` does not need it.

Read the full pinned specification ↗

Relationships

Claimed units

  • establishes
    {
  "kind": "file",
  "path": ".github/workflows/scorecard.yml"
}

Source headings

  1. 202: OpenSSF Scorecard reports on main
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 3.1 Triggers
  6. 3.2 Least privilege
  7. 3.3 Output
  8. 3.4 Every action pinned
  9. 3.5 Not a gate
  10. 4. Out of scope
  11. 5. Resolved decisions
  12. Verification

Frozen anchors

No frozen anchors declared.