Repository navigation
org-scorecard: exempt first-party channel-tag reusable refs from Pinned-Dependencies findings #709
Description
Problem
org-scorecard.yml creates/updates a "Scorecard: Pinned-Dependencies" issue per repo whenever the check is below 10/10, and only auto-closes it when the check reaches 10/10 (see the close path around L132-134).
Since the canary rollout strategy (#657 major-scoped channels) moved first-party reusable-workflow refs to mutable channel tags (<agent>/v<M>-<tier>) by design, the Pinned-Dependencies check can never reach 10/10 on any repo that consumes our reusables. Result: these issues never self-close and accumulate weekly "score is now N/10" comments forever.
This is the same first-party exception already codified for the compliance-audit action-pinning check:
standards/ci-standards.md#exception-internal-reusable-workflow-references("intentionally use tags and must NOT be SHA-pinned")- PR fix: exempt internal reusable workflow refs from action-pinning check #242 (grep exclusion for
petry-projects/.github/refs) .github-private#687(generalized "reject SHA / #main pins on any first-party reusable")
The org-scorecard issue-creator never got the same exception, so it keeps generating noise.
Scope
11 open "Scorecard: Pinned-Dependencies" issues were closed as accepted-exception on 2026-07-13 (this issue tracks stopping their recurrence): .github#316, .github-private#214, broodly#18, TalkTerm#20, google-app-scripts#87, bmad-bgreat-suite#159, ContentTwin#159, incubator#15, repo-template#27, broodminder-export#31, markets#274.
Proposed fix (pick one)
Option A — simplest: add Pinned-Dependencies to the existing SKIP_CHECKS list in org-scorecard.yml. Rely on compliance-audit.sh's check_action_pinning (which already exempts first-party and still flags unpinned third-party actions) as the enforcement mechanism for third-party pinning. Loses the Scorecard sub-score signal but removes all noise.
Option B — surgical: keep the check, but for Pinned-Dependencies parse the Scorecard JSON details[] and skip issue create/update when every unpinned-dependency detail references a first-party petry-projects/.github / .github-private reusable ref. Preserves third-party gap detection (e.g. broodminder-export 2/10, incubator 3/10 have real third-party gaps) while suppressing the structural first-party dock.
Recommendation: Option B — several repos have genuine third-party unpinned actions that we still want surfaced; a blanket skip would hide those.
Acceptance
- No new "Scorecard: Pinned-Dependencies" issue is created for a repo whose only unpinned deps are first-party reusable refs.
- Repos with unpinned third-party actions still get a finding.
- Standard documented in
ci-standards.md#openssf-scorecard-org-scorecardyml.
Activity
don-petry commentedon Jul 14, 2026
Fix implemented — PR #716
Chose a refined Option B over A. Key finding while implementing: Scorecard's Pinned-Dependencies
details[]give only the workflow file:line, not the referenced ref, and Scorecard classespetry-projects/*as 'third-party' — so a pure first-party/third-party split isn't possible from the JSON. But the detail messages name the dependency type (GitHubAction,containerImage,pipCommand, …), which is enough:not pinned by hashdetail is aGitHubAction— third-party actions are already enforced bycompliance-audit.sh check_action_pinning(first-party exempt), and first-party channel tags are deliberate.SKIP_CHECKS(Option A) would have lost.Documented in
ci-standards.md#openssf-scorecard. Once #716 merges, Monday's scan won't recreate the 11 closed issues. Closable on merge.fix(scorecard): exempt first-party channel-tag refs from Pinned-Depen…
fix(scorecard): pass --show-details so the #709 exemption fires; refr…
don-petry commentedon Oct 21, 2026
Closing after the 2026-10-21 backlog triage.
Why: Exemption shipped and fixed to fire; no Pinned-Dependencies issue open.
Evidence: PRs #716, #1357 (2026-10-20)
Reopen if this still reproduces on main.