open-telemetry / open-telemetry/shared-workflows
Remove temporary Scorecard $/ reference filter
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 7
- Forks
- 18
- Avg merge
- 22h 1m
- Merged PRs (30d)
- 75
Description
OpenSSF Scorecard currently misclassifies GitHub's $/ same-repository action syntax as an unpinned third-party dependency. The shared Scorecard workflow filters those false positives from its code-scanning upload.
Remove the filter after ossf/scorecard#5232 is fixed and a release containing the fix is used by ossf/scorecard-action:
- update the pinned Scorecard action if needed
- remove the
self_repository_referenceSARIF filter from.github/workflows/scorecard.yml - remove the temporary note from
scorecard/README.md - confirm the
$/references no longer producePinnedDependenciesIDalerts
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
First check whether ossf/scorecard#5232 is fixed and whether a release containing it is used by ossf/scorecard-action. Then inspect .github/workflows/scorecard.yml and scorecard/README.md for the pinned action, self_repository_reference filter, and temporary note. Done means the filter and note are removed, the action is current if needed, and $/ references no longer produce PinnedDependenciesID alerts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100