Resolve 3 open Scorecard alerts (#63 Pinned-Deps, #72 SAST, #44 Maintained)

Refs hyperpolymath/hypatia#260 (root-cause + anti-recurrence). Do not auto-close.

chore(ci): add dormant push-email notification workflow #72 SAST — codeql.yml matrix was javascript-typescript; repo is Ada/Scheme/Shell so CodeQL recorded 0 results → "0/7 commits checked". Fix: matrix → language: actions (always scannable, runs every commit). (this PR)
ci(scorecard): add job-level permissions for reusable workflow #63 Pinned-Dependencies — generator-generic-ossf-slsa3-publish.yml:68 uses slsa-framework/slsa-github-generator/...@v2.1.0. SHA-pinning the SLSA generator is harmful (it self-verifies github.ref; SHA-ref → invalid provenance). Accepted false-positive → dismissed with rationale.
chore: Item 10 — migrate .scm metadata family → .a2ml (Track A, faithful) #44 Maintained — 0 commits/issues in 90d. Scorecard states no remediation needed; informational activity signal → dismissed with rationale (and resolved by activity).

fix(ci): point CodeQL at `actions` so SAST runs every commit (#72) (#41)

Jointly closed by explicit maintainer agreement (2026-05-17). #72 SAST fixed via modshells#41 (CodeQL matrix → actions; auto-clears on next Scorecard run). #63 (Pinned-Deps/SLSA) and #44 (Maintained) are no longer open code-scanning alerts. Validated live by hyperpolymath/hypatia ScorecardReconciler (2026-05-17): found=1 (only #72, action=fix), recurrence_defects=[], decision recorded to the offline registry. Refs hyperpolymath/hypatia#260.

Navigation Menu

Repository navigation

Resolve 3 open Scorecard alerts (#63 Pinned-Deps, #72 SAST, #44 Maintained) #40

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Resolve 3 open Scorecard alerts (#63 Pinned-Deps, #72 SAST, #44 Maintained) #40

Description

Activity

hyperpolymath commented on May 17, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions