From 9670b9d8f3f57d7358a356fab1e9046e28c5f5ac Mon Sep 17 00:00:00 2001 From: Aleksandar Grbic Date: Sat, 22 Aug 2026 22:50:14 +0200 Subject: [PATCH] ci: treat Branch-Protection as a one-maintainer Scorecard residual A second human reviewer is not available in this org. Keep the live gate at one review plus the maintainer bypass, and strip BranchProtectionID from the code-scanning upload so weekly Scorecard does not reopen it. --- .github/workflows/security-scorecard.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/security-scorecard.yml b/.github/workflows/security-scorecard.yml index d468b8b..ed3aa1e 100644 --- a/.github/workflows/security-scorecard.yml +++ b/.github/workflows/security-scorecard.yml @@ -35,9 +35,9 @@ jobs: path: scorecard-results.sarif retention-days: 5 # Full Scorecard still publishes to scorecard.dev. These checks cannot - # reach 10 on a one-maintainer template (second human reviewer, CII badge - # signup, historical CI/SAST coverage, fuzzing). Strip them from the - # GitHub code-scanning upload so weekly runs do not reopen accepted risk. + # reach 10 on a one-maintainer org (no second reviewer, CII badge signup, + # historical CI/SAST coverage, fuzzing). Strip them from the GitHub + # code-scanning upload so weekly runs do not reopen accepted risk. - name: Filter residual Scorecard rules from code scanning run: | jq ' @@ -45,7 +45,7 @@ jobs: .results |= map( select( .ruleId as $id - | ["CodeReviewID", "CIIBestPracticesID", "SASTID", "CITestsID", "FuzzingID"] + | ["CodeReviewID", "CIIBestPracticesID", "SASTID", "CITestsID", "FuzzingID", "BranchProtectionID"] | index($id) | not )