fix(scorecard): exempt first-party channel-tag refs from Pinned-Dependencies (#709) - #716
Conversation
…dencies (#709) org-scorecard created a 'Scorecard: Pinned-Dependencies' issue per repo below 10/10 and only closed it at 10/10. Our first-party reusable refs deliberately use mutable channel tags (ci-standards#action-pinning-policy), so that check can never reach 10/10 — the issue never closed and recreated after any manual close (the 11 closed on 2026-07-13 would reappear on the next Monday scan). Third-party ACTION pinning is already enforced by compliance-audit.sh check_action_pinning (which exempts first-party), so an Actions-only Pinned-Dependencies finding is redundant noise. Suppress the issue (and close any existing one) only when EVERY 'not pinned by hash' detail is a GitHubAction; keep it whenever there's a non-Actions gap (container image / pip / npm / go) that nothing else tracks — keying off Scorecard's per-detail dependency type. Errs toward keeping the issue if the detail wording is unexpected. Documented in ci-standards.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Juznz5V6su81ffSND8fg7s
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 3 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates standards/ci-standards.md to document a first-party exemption for the Pinned-Dependencies check, explaining how mutable channel tags are handled and how third-party action pinning is already enforced. The review feedback suggests a minor terminology change from 'mutable channel tags' to 'moving channel tags' to maintain consistency with the rest of the document.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
There was a problem hiding this comment.
Pull request overview
Adjusts the org-wide Scorecard issue automation to stop “Pinned-Dependencies” issues from looping forever when the only unpinned items are GitHub Actions (impacted by the deliberate first-party channel-tag strategy), while preserving signal for non-Actions dependency pinning gaps.
Changes:
- Adds a Pinned-Dependencies exemption in
org-scorecard.ymlto suppress/auto-close the issue when all “not pinned” details are Actions-only. - Documents the first-party exemption rationale in
standards/ci-standards.md.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| standards/ci-standards.md | Documents why Actions-only Pinned-Dependencies findings are suppressed and what remains enforced. |
| .github/workflows/org-scorecard.yml | Implements suppression/auto-close logic for Actions-only Pinned-Dependencies findings to prevent recurring noise. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
|
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: b5415470ad965826b55768fcda1f977a1288555f
Review mode: triage-approved (single reviewer)
Summary
Adds a narrowly-scoped exemption to org-scorecard.yml so Pinned-Dependencies issues are suppressed (and auto-closed) only when every 'not pinned by hash' detail is a GitHubAction — covered by compliance-audit.sh for third-party and deliberate for first-party channel tags. Non-Actions gaps (container/pip/npm/go) still raise issues. Documented in ci-standards.md.
Linked issue analysis
References #709 (Pinned-Dependencies issue loop). The fix directly addresses the root cause: the issue could never reach 10/10 due to deliberate first-party channel tags, so it recreated after every manual close. The suppression is conditional on the finding being Actions-only, preserving signal for non-Actions pinning gaps that nothing else tracks. Substantively addressed.
Findings
- Logic verified in context: TOTAL_WARN > 0 guard ensures the expected detail format is present before suppressing (addresses Copilot's prior zero-details concern); both jq error fallbacks (TOTAL_WARN=0, NON_ACTION_WARN=1) fail toward keeping the issue. CLOSED_COUNT/EXISTING_ISSUE defined upstream; MALFORMED_WORKFLOW path cannot reach the new block with unset ROW.
- No injection surface: scorecard details flow only into jq; the auto-close comment is static text; issue numbers come from gh --json output.
- Both prior review threads (gemini-code-assist terminology, copilot-pull-request-reviewer zero-details suppression) are resolved and fixed in the current head.
- Minor, non-blocking: package-lock.json and node_modules/.package-lock.json name field changed pr-681 → pr-716 (cosmetic, matches pre-existing bot-managed lockfile pattern).
- Secret scanning MCP tool unavailable in this environment; gitleaks CI check passed at head SHA.
CI status
All checks green at head SHA b541547: Lint, ShellCheck, CodeQL, gitleaks, Agent Security Scan, AgentShield, SonarCloud (quality gate passed, 0 issues), Dependency audit, CodeRabbit (approved). Two CANCELLED dev-lead runs are superseded duplicates of a later successful run.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: fd293a69e1fa067ab0cd52f5db4f6dc68ed00c19
Review mode: triage-approved (single reviewer)
Summary
Adds a narrowly-scoped exemption in org-scorecard.yml so a Pinned-Dependencies finding is suppressed (and any existing issue auto-closed) only when at least one 'not pinned by hash' detail exists AND every such detail is a GitHubAction — third-party action pinning is already enforced by compliance-audit.sh and first-party channel tags are deliberate policy. Non-Actions gaps (container/pip/npm/go) still raise issues, and unexpected detail formats err toward keeping the issue. Documents the exemption in ci-standards.md. Since the prior approval at b541547, the only change is a merge of main (PR #717); the PR's own diff is unchanged.
Linked issue analysis
References #709 (org-scorecard: exempt first-party channel-tag reusable refs from Pinned-Dependencies findings). The PR substantively addresses it: the never-self-closing issue loop is broken for Actions-only findings while preserving Scorecard signal for non-Actions dependency types that nothing else tracks. Not in closingIssuesReferences, so #709 will need manual closure after the next scan validates the behavior.
Findings
- Exemption block verified in context at the PR head:
ROW,EXISTING_ISSUE, andCLOSED_COUNTare all in scope at the insertion point, and the malformed-workflow path cannot reach it (CHECK_NAMEdiffers)..details[]?handles null details (TOTAL_WARN=0 → issue kept), and both jq fallbacks default to the safe "keep the issue" outcome. - Both review threads are resolved and the fixes are verified in the diff: Copilot's zero-details suppression bug → fixed with the
TOTAL_WARN -gt 0gate; gemini's terminology nit → "moving channel tags" now used in ci-standards.md. - No new shell-injection surface: the auto-close comment is a static string;
$EXISTING_ISSUE,$ORG,$REPOfollow the pre-existing pattern in this script. - Informational:
package-lock.json/node_modules/.package-lock.jsonname field changedpr-681→pr-716(repo automation artifact); no dependency changes, npm audit green. - Secret scanning MCP tool not available in this run; gitleaks CI check passed (no fabricated MCP result).
CI status
All checks green: Lint, ShellCheck, CodeQL, SonarCloud (quality gate passed, 0 new issues), agent-shield, Agent Security Scan, gitleaks, npm audit all SUCCESS; ecosystem audits skipped (not applicable). Two early dev-lead dispatch/ci-relay entries show CANCELLED but were superseded by later SUCCESS runs.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Problem
org-scorecard.ymlcreates aScorecard: Pinned-Dependenciesissue per repo scoring <10/10 and only closes it at 10/10. Our first-party reusable refs deliberately use mutable channel tags (ci-standards#action-pinning-policy), so that check can never reach 10/10 — the issue never self-closes and recreates after any manual close (the 11 closed on 2026-07-13 would reappear on the next Monday scan). Full write-up: #709.Why not just skip the check
Scorecard
Pinned-Dependenciesalso covers non-Actions deps (container images, pip/npm/go), which nothing else tracks — so a blanketSKIP_CHECKSentry would lose real signal. And third-party action pinning is already enforced bycheck_action_pinningincompliance-audit.sh(which exempts first-party), so the Actions portion is pure noise.Fix
Scorecard's per-detail messages name the dependency type (
GitHubAction,containerImage,pipCommand, …). ForPinned-Dependencies:not pinned by hashdetail is aGitHubAction→ covered by compliance-audit (third-party) + deliberate (first-party).Documented the exemption in
ci-standards.md.Validation
bash -nclean; yamllint clean (repo config, max 200); markdown lines well under MD013 (200).Effect
Next Monday's scan will not recreate the 11 closed Pinned-Dependencies issues (unless a repo has a genuine non-Actions pinning gap, which is correctly surfaced).
🤖 Generated with Claude Code
https://claude.ai/code/session_01Juznz5V6su81ffSND8fg7s