💡 Automated OpenSSF Scorecard Remediation Pipeline

[github-actions[bot]]

Summary

Extend the existing compliance self-healing pipeline concept to automatically generate fix PRs for OpenSSF Scorecard findings, starting with the critical 0/10 checks (Security-Policy, License) and progressing to Token-Permissions (7/10), Pinned-Dependencies (7/10), and Code-Review (6/10) improvements. Most scorecard checks have deterministic fixes that are ideal for automation.

Market Signal

OpenSSF Scorecard now runs billions of evaluations monthly and integrates deeply with SLSA, Sigstore, OSV.dev, and SBOM workflows. GitHub's Scorecards v4 Action is free for all public repositories. The supply chain security landscape is standardizing around scorecard metrics as a trust signal for open-source consumers — a poor scorecard directly impacts how the org's open-source repos are perceived.

User Signal

Six open scorecard issues (#313-#318) show sub-optimal scores: Security-Policy 0/10, License 0/10, Code-Review 6/10, Pinned-Dependencies 7/10, Token-Permissions 7/10, Branch-Protection 8/10. Issue #35 requests automated remediation of recurring compliance findings. Discussion #270 "Automated Compliance Self-Healing Pipeline" provides the architectural foundation. The 0/10 scores have been open since May 17 without manual remediation.

Technical Opportunity

The org-scorecard.yml workflow already runs and generates findings. The compliance-audit.sh (77KB) already handles issue creation and remediation tracking. Most scorecard checks have deterministic fixes: Security-Policy requires a SECURITY.md file, License requires a LICENSE file, Token-Permissions requires adding permissions: blocks to workflows, Pinned-Dependencies requires SHA pinning (already partially handled by Dependabot). This is an integration into existing infrastructure, not a new system.

Assessment

Dimension	Score	Rationale
Feasibility	high	Scorecard fixes are deterministic; compliance-audit infra already exists
Impact	high	Directly improves security posture across all repos; two checks at 0/10
Urgency	high	0/10 scores on Security-Policy and License are critical gaps open since May 17

Adversarial Review

Strongest objection: The scorecard checks are already tracked as issues. Adding another automated pipeline adds complexity when someone could just fix them manually in an afternoon.
Rebuttal: The 0/10 scores have been open since May 17 without manual remediation — "just fix it" isn't happening. The org has a proven pattern of automated remediation (compliance-audit creates issues, agents fix them). The deterministic nature of scorecard fixes (create file, add permissions block, pin SHA) makes them ideal candidates for automation. The compliance-audit.sh already has the infrastructure; this is adding a new remediation category, not a new system.

Suggested Next Step

Add a scorecard-remediation category to compliance-audit.sh that generates fix PRs for deterministic checks (SECURITY.md creation, LICENSE file addition, workflow permissions: blocks), starting with the two 0/10 findings. Related: Discussion #270, Issue #35.