Adds scorecard annotations (#6979)

nodejs · Sep 13, 2024 · 991be60 · 991be60
1 parent ac3f5bb
commit 991be60
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/.github/scorecard.yml b/.github/scorecard.yml
@@ -0,0 +1,8 @@
+# annotations tell scorecard that we have mitigated a concern. automation is only so good at establishing context
+# https://github.com/ossf/scorecard/blob/main/config/README.md#annotating-your-project
+annotations:
+  # our workflows only run when a maintainer allows it
+  - checks:
+      - dangerous-workflow
+    reasons:
+      - reason: remediated