search

ossf / scorecard

OpenSSF Scorecard - Security health metrics for Open Source
https://scorecard.dev
Apache License 2.0
4.63k stars 504 forks source link

🌱 Update active `cisco` projects, remove `cisco-open` projects #4226

Closed lelia closed 4 months ago

lelia commented 4 months ago

What kind of change does this PR introduce?

Updates the active list of cisco projects, and removes cisco-open projects from the weekly cronjob.

We have recently installed the Scorecard Action on all cisco-open projects, and are using Scorecard Monitor to further evaluate each project, so we want to ensure only the results from the Action are being used, given the known limitations with Scorecard results from the cronjob.

What is the current behavior?

Currently, only some cisco projects are checked by Scorecard, and all cisco-open projects are included.

Which issue(s) this PR fixes

NONE

Does this PR introduce a user-facing change?

NONE
spencerschrock commented 4 months ago

are using Scorecard Monitor to further evaluate each project, so we want to ensure only the results from the Action are being used

Currently the API prioritizes the action results over the cron results already. Were you seeing otherwise?

lelia commented 4 months ago

are using Scorecard Monitor to further evaluate each project, so we want to ensure only the results from the Action are being used

Currently the API prioritizes the action results over the cron results already. Were you seeing otherwise?

No issues with that currently, but we have some older Scorecard Monitor reports with results from the cronjob that were causing some confusion when trying to analyze overall project health, so I wanted to create a clean separation.

I don't anticipate there being collisions with reports we run in the future, but there's less value in having /cisco-open projects analyzed by the cronjob, compared with /cisco projects, which we have limited access to influence directly.