The two remaining Scorecard zeros from #39. Both are decisions, not code changes, so they get a narrow issue instead of keeping that broad one open.
Code-Review 0/10
Scorecard found no approved changesets among recent PRs — every PR here is self-merged, which is what a single-maintainer repository looks like. GitHub forbids approving your own PR, so there is no repository-side fix. The options:
- recruit a second reviewer from the cloudfoundry-community org onto PRs (and optionally require an approving review in the
master branch protection), or
- record explicitly that this check cannot pass for a single-maintainer library and accept the 0.
Pinned-Dependencies 0
GitHub Actions are referenced by tag rather than SHA. This was deliberate — the identical finding from zizmor (unpinned-uses) was accepted on the same grounds — but the decision is not recorded anywhere durable, so it keeps reading as an oversight. The options:
- pin to SHAs and absorb the Dependabot churn, or
- write the acceptance down somewhere durable (a docs note or SECURITY.md) and stop re-investigating it.
Either direction resolves this issue; the point is that the state be chosen rather than drifted into.
The two remaining Scorecard zeros from #39. Both are decisions, not code changes, so they get a narrow issue instead of keeping that broad one open.
Code-Review0/10Scorecard found no approved changesets among recent PRs — every PR here is self-merged, which is what a single-maintainer repository looks like. GitHub forbids approving your own PR, so there is no repository-side fix. The options:
masterbranch protection), orPinned-Dependencies0GitHub Actions are referenced by tag rather than SHA. This was deliberate — the identical finding from zizmor (
unpinned-uses) was accepted on the same grounds — but the decision is not recorded anywhere durable, so it keeps reading as an oversight. The options:Either direction resolves this issue; the point is that the state be chosen rather than drifted into.