OpenSSF Scorecard

Live score

Aggregate score 8.3 / 10 at 2026-10-29T07:04:00Z.

Refresh: scripts/qa/scorecard-snapshot.sh · Monitoring: .github/workflows/scorecard.yml.

The badge above is regenerated every Monday at 06:00 UTC and on every push to main by .github/workflows/scorecard.yml. The SARIF result is uploaded to GitHub Code Scanning (Security tab) and retained as a 30-day workflow artifact.

Threshold policy

Regressions are triaged within one Monday cycle: identify the check that dropped, either remediate or file an exception entry below with a rationale and an expiry date.

Per-check posture (snapshot, main HEAD)

The checks below come from OpenSSF Scorecard's published rubric. Tick marks reflect this repo's posture at the time of writing — the live badge is authoritative if these diverge.

Open findings

Scorecard raises these as alerts at https://github.com/sebastienrousseau/dotfiles/security/code-scanning. Each row gives the dismissal reason and the exact comment text to paste when triaging. Every alert listed here has been dismissed with that reason; when Scorecard re-raises one (for example after the line moves), dismiss it again with the same text.

Bucket 1 — Dismiss in the UI

Scorecard flags every npm install, pip install, go install, and curl | sh invocation under the Pinned-Dependencies check. The rows below either belong to user-facing tooling that installs the latest release on purpose or are false positives in Scorecard's regex.

Bucket 2 — Architectural (1 item)

Closed this cycle

Open work

• harden-runner block-mode adoption (#878): should tighten the Token-Permissions check further.
• Branch-Protection 3/10: the live score is held down by the 0-approval review setting on a single-maintainer repo (see Bucket 2).

Enabling Branch-Protection + Webhooks checks in the workflow (one-time PAT setup)

The repository's own scorecard.yml run needs a fine-grained Personal Access Token with Administration: read scope to read the Branch-Protection and Webhooks checks; without it both return -1 ("internal error") in that run. (The public snapshot above comes from the Scorecard API, which scores Branch-Protection on its own.) The workflow already wires this up, and the SCORECARD_TOKEN secret is not set today.

Steps (one-time, repo owner):

1. Go to https://github.com/settings/personal-access-tokens/new
2. Resource owner: sebastienrousseau · Repository access: only sebastienrousseau/dotfiles
3. Repository permissions → Administration: read-only and Metadata: read-only
4. Expiration: 1 year (set a calendar reminder to rotate; document the rotation in this file when done)
5. Generate the token, copy it once
6. Add as a secret named SCORECARD_TOKEN at https://github.com/sebastienrousseau/dotfiles/settings/secrets/actions/new
7. Next Scorecard run (manual via gh workflow run scorecard.yml or weekly cron) picks it up automatically
8. Expected effect: Branch-Protection -1 → 10/10 if all rules are correctly configured; Webhooks -1 → 10/10 (no webhooks present).

The PAT secret is optional. When absent, the workflow falls back to ${{ github.token }} and Scorecard continues to run, only with those two checks at -1. Adding the PAT cannot reduce any other check's score — it's a strict improvement.

Exceptions

If you add an exception, include the check name, an expiry date (don't allow indefinite), and the rationale. Re-evaluate every quarter.

Refreshing this document

# Re-count open alerts:
gh api 'repos/sebastienrousseau/dotfiles/code-scanning/alerts?state=open&per_page=50' \
  --jq '[.[].rule.id] | group_by(.) | map({rule: .[0], count: length})'

# Trigger Scorecard manually:
gh workflow run scorecard.yml --ref main

If a new category appears, add a row to the matching bucket. If a remediation closes one of the rows above, delete the row.

References

• .github/workflows/scorecard.yml — the scanner workflow (split into analysis + track-regression jobs per #885).
• Scorecard project.
• Scorecard checks reference.
• Tracking issue #869.