allstar-staging[bot]
commented
1 month ago The policy result has been updated.
Project is out of compliance with OpenSSF Scorecard policy.
Rule Description This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check. The score was 0, and the passing threshold is 5. Results from policy: Code-Review : Found 0/7 approved changesets -- score normalized to 0
Results from policy: Dependency-Update-Tool : no update tool detected
- no dependency update tool configurations found
Results from policy: Fuzzing : project is not fuzzed
- no fuzzer integrations found
Results from policy: License : license file not detected
- project does not have a license file
- project does not have a license file
Results from policy: Maintained : project was created in last 90 days. please review its contents carefully
- Repository was created in last 90 days.
Results from policy: Pinned-Dependencies : dependency not pinned by hash detected -- score normalized to 0
- .github/workflows/scm.yaml[19]:GitHub-owned GitHubAction not pinned by hash
- .github/workflows/scm.yaml[21]:third-party GitHubAction not pinned by hash
- [0]: 0 out of 1 GitHub-owned GitHubAction dependencies pinned
- [0]: 0 out of 1 third-party GitHubAction dependencies pinned
Results from policy: SAST : no SAST tool detected
- [0]:no pull requests merged into dev branch
Results from policy: Token-Permissions : detected GitHub workflow tokens with excessive permissions
- write[12]:topLevel 'issues' permission set to 'write'
- not a publishing workflow: .github/workflows/scm.yaml
- not a releasing workflow: .github/workflows/scm.yaml
- not a GitHub Pages deployment workflow: .github/workflows/scm.yaml
- not a SARIF workflow, or not an allowed one
- no jobLevel permission defined
- write[8]:topLevel 'contents' permission set to 'write'
- found token with 'none' permissions
- found token with 'none' permissions
- [0]:no jobLevel write permissions found
This issue was automatically created by Allstar and refers to jeffmendoza-test-org/scm-test-repo.
Security Policy Violation Project is out of compliance with OpenSSF Scorecard policy.
Rule Description This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check. The score was 0, and the passing threshold is 5. Results from policy: Code-Review : Found 0/6 approved changesets -- score normalized to 0
Results from policy: Dependency-Update-Tool : no update tool detected
Results from policy: Fuzzing : project is not fuzzed
Results from policy: License : license file not detected
Results from policy: Maintained : project was created in last 90 days. please review its contents carefully
Results from policy: Pinned-Dependencies : dependency not pinned by hash detected -- score normalized to 0
Results from policy: SAST : no SAST tool detected
Results from policy: Token-Permissions : detected GitHub workflow tokens with excessive permissions
:warning: There is an updated version of this policy result! Click here to see the latest update
This issue will auto resolve when the policy is in compliance.
Issue created by Allstar. See https://github.com/ossf/allstar/ for more information. For questions specific to the repository, please contact the owner or maintainer.