You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
Running scorecard with --local only allows it to run 6 checks. Of the 12 that aren't run, I propose that 6 be allowed to run, even if the results may be incomplete when compared with the upstream:
Fuzzing
License
Maintained
Packaging
SAST
Security-Policy
Describe the solution you'd like
Fuzzing only requires a non-local repo for OSS-Fuzz, all other fuzzers are detected using files in the repository itself. With --local, we simply don't look for OSS-Fuzz.
License tries to use the platform's API, but it already has fallback methods to scan the repository itself. With --local, we simply use the fallbacks.
Maintained can score a --local repo using just the commit activity: use git log to detect the frequency of commits and use the date of the root commit to determine whether the repo is 90+ days old.
Packaging currently looks for release workflows and then checks to see if they've ever passed. With --local, it could skip that later step.
SAST looks for workflows with CodeQL or SonarCloud and sees if they're run on PRs (or something like that?). With --local, it could simply reward for having a SAST workflow.
Security-Policy looks for a policy in the repo or the org's .github repo. With --local, it could just look in the repo.
In all of these cases, Scorecard should log that the results are potentially incomplete/unrepresentative of the upstream repository.
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
Running scorecard with
--local
only allows it to run 6 checks. Of the 12 that aren't run, I propose that 6 be allowed to run, even if the results may be incomplete when compared with the upstream:Describe the solution you'd like
--local
, we simply don't look for OSS-Fuzz.--local
, we simply use the fallbacks.--local
repo using just the commit activity: usegit log
to detect the frequency of commits and use the date of the root commit to determine whether the repo is 90+ days old.--local
, it could skip that later step.--local
, it could simply reward for having a SAST workflow.--local
, it could just look in the repo.In all of these cases, Scorecard should log that the results are potentially incomplete/unrepresentative of the upstream repository.
The text was updated successfully, but these errors were encountered: