OpenSSF Scorecard

Live score

Aggregate score 7.6 / 10 at 2026-05-17T08:11:51Z.

Refresh: scripts/qa/scorecard-snapshot.sh · Monitoring: .github/workflows/scorecard.yml.

The badge above is regenerated every Monday at 06:00 UTC and on every push to main by .github/workflows/scorecard.yml. The SARIF result is uploaded to GitHub Code Scanning (Security tab) and retained as a 30-day workflow artifact.

Threshold policy

Regressions are triaged within one Monday cycle: identify the check that dropped, either remediate or file an exception entry below with a rationale and an expiry date.

Per-check posture (snapshot, main HEAD)

The checks below come from OpenSSF Scorecard's published rubric. Tick marks reflect this repo's posture at the time of writing — the live badge is authoritative if these diverge.

Open findings

The eight items below are surfaced as alerts at https://github.com/sebastienrousseau/dotfiles/security/code-scanning. Each row gives the dismissal reason and the exact comment text to paste when triaging.

Bucket 1 — Dismiss in the UI (5 items)

Scorecard flags every npm install, pip install, go install, and curl | sh invocation under the Pinned-Dependencies check. The five below either belong to user-facing "update everything" aliases or are false positives in Scorecard's regex.

Bucket 2 — Architectural (1 item)

Bucket 3 — External action (2 items)

Closed this cycle

Open work

• Apply for the OpenSSF Best Practices Badge — see Bucket 3 above. All passing-tier criteria are now met (signed commits, CI, security policy, MIT license, MAINTAINERS.md, GOVERNANCE.md, RFC process documented).
• Re-trigger Scorecard after SLSA backfill propagates — expected Signed-Releases 3 → 10.
• harden-runner block-mode adoption (#878) — should tighten the Token-Permissions check further.
• Investigate License 9/10 false-positive — repo is MIT (SPDX-compliant), Scorecard's penalty should not apply.
• Investigate Branch-Protection -1 — scanner internal error; manually verify with gh api repos/:owner/:repo/branches/main/protection and document.

Enabling Branch-Protection + Webhooks checks (one-time PAT setup)

Scorecard's Branch-Protection and Webhooks checks require a fine-grained Personal Access Token with Administration: read scope. Without it both checks return -1 ("internal error"). The workflow already wires this up — only the secret needs to be created.

Steps (one-time, repo owner):

1. Go to https://github.com/settings/personal-access-tokens/new
2. Resource owner: sebastienrousseau · Repository access: only sebastienrousseau/dotfiles
3. Repository permissions → Administration: read-only and Metadata: read-only
4. Expiration: 1 year (set a calendar reminder to rotate; document the rotation in this file when done)
5. Generate the token, copy it once
6. Add as a secret named SCORECARD_TOKEN at https://github.com/sebastienrousseau/dotfiles/settings/secrets/actions/new
7. Next Scorecard run (manual via gh workflow run scorecard.yml or weekly cron) picks it up automatically
8. Expected effect: Branch-Protection -1 → 10/10 if all rules are correctly configured; Webhooks -1 → 10/10 (no webhooks present).

The PAT secret is optional. When absent, the workflow falls back to ${{ github.token }} and Scorecard continues to run, only with those two checks at -1. Adding the PAT cannot reduce any other check's score — it's a strict improvement.

Exceptions

If you add an exception, include the check name, an expiry date (don't allow indefinite), and the rationale. Re-evaluate every quarter.

Refreshing this document

# Re-count open alerts:
gh api 'repos/sebastienrousseau/dotfiles/code-scanning/alerts?state=open&per_page=50' \
  --jq '[.[].rule.id] | group_by(.) | map({rule: .[0], count: length})'

# Trigger Scorecard manually:
gh workflow run scorecard.yml --ref main

If a new category appears, add a row to the matching bucket. If a remediation closes one of the rows above, delete the row.

References

• .github/workflows/scorecard.yml — the scanner workflow (split into analysis + track-regression jobs per #885).
• Scorecard project.
• Scorecard checks reference.
• Tracking issue #869.