-
Notifications
You must be signed in to change notification settings - Fork 70
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: run scorecard only once #1071
Comments
@justaugustus this is another problem with the current cobra-hooking entrypoint method we do today. Has Cisco run into any rate limiting that this could remediate? (@lelia may have more context?) |
Note: I temporarily instrumented my Scorecard fork's call to ossf/scorecard-action with calls to GitHub's The way we run Scorecard twice when publishing results, would therefore waste an extra 66 core and 4 graphql, or ~7% of a repo's hourly quota.
So with the duplicate call, a repo would currently exhaust their hourly quota in 8 commits (assuming no other usage), which isn't great but also not the end of the world. (Runtime is another factor though). |
As far as I'm aware, we haven't hit this rate limit with any of our projects yet — most of the scaling challenges we faced were due to the employment of reusable workflows across multiple orgs. The duplicate call is definitely something I'll keep an eye on as we start leveraging Scorecard across more projects, though. |
The Action runs scorecard twice: once for the SARIF results, and once to upload the results to the API server. This increases rate limits and is also slower.
We need to run scorecard once only, then:
/cc @naveensrinivasan @azeemsgoogle
The text was updated successfully, but these errors were encountered: