From 1e76281a990eea86526eed0d60decfbde728aab8 Mon Sep 17 00:00:00 2001 From: Aleksandar Grbic Date: Sat, 22 Aug 2026 22:44:00 +0200 Subject: [PATCH] ci: keep accepted Scorecard residuals out of code scanning --- .github/workflows/security-scorecard.yml | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/.github/workflows/security-scorecard.yml b/.github/workflows/security-scorecard.yml index b95f433..d468b8b 100644 --- a/.github/workflows/security-scorecard.yml +++ b/.github/workflows/security-scorecard.yml @@ -34,6 +34,24 @@ jobs: name: scorecard-results path: scorecard-results.sarif retention-days: 5 + # Full Scorecard still publishes to scorecard.dev. These checks cannot + # reach 10 on a one-maintainer template (second human reviewer, CII badge + # signup, historical CI/SAST coverage, fuzzing). Strip them from the + # GitHub code-scanning upload so weekly runs do not reopen accepted risk. + - name: Filter residual Scorecard rules from code scanning + run: | + jq ' + .runs |= map( + .results |= map( + select( + .ruleId as $id + | ["CodeReviewID", "CIIBestPracticesID", "SASTID", "CITestsID", "FuzzingID"] + | index($id) + | not + ) + ) + ) + ' scorecard-results.sarif > scorecard-results.code-scanning.sarif - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: - sarif_file: scorecard-results.sarif + sarif_file: scorecard-results.code-scanning.sarif