Repository navigation
Auto-released from the merge of #27 (trigger: push).
Merge gates: what stands between a pull request and the default branch.
- merges do not wait for any check: pull requests get checks, but no ruleset or branch
protection requires one, so a red pull request can merge. - required checks no pull request reports: a required check name that no recent pull request
produced, such as a renamed job or a path-filtered workflow. GitHub waits for it forever. - pull request checks merges do not wait for: a test, build, analysis or fuzzing check that pull
requests get but the branch doesn't require. This is a guard, judged from the check's name. - no workflow checks pull requests, no code scanning, no dependency updates: the
workflows a supply-chain review expects, when the listings show they are missing.
Checked against 1,224 workflow files from 40 popular repositories (no crash, no parse failure,
and every untrusted expression found in a script was one the scan reports):
- Unpinned references by owner: the evidence says who can move each reference: a third
party, the repository's owner, GitHub, or the repository itself. The repository's own reusable
workflow at a branch gets a local./call as its example, which runs from the caller's commit
and needs no pin. Its own step actions are pinned like the owner's others. - More code scanners: Semgrep, Snyk, SonarSource's scan actions, Bearer (by action, container
image or command) and code-scanner SARIF uploads now count as code scanning. Scorecard and
workflow-linter uploads don't, and neither does SonarSource's quality-gate action. - One parse per file: within an audit, each distinct workflow file is parsed once and shared
by the measurements, the scans and the gate checks. The parses are dropped when the audit ends. - Each guard says what it guards against: the required-checks guard read "a guard against
hung jobs", the timeout finding's wording, and the summary counted it among them. Each guard
now names its own purpose, and one unrequired check reads in the singular. - Grouped findings show each workflow's figure: a self-hosted tail, toolchain setup, queue
wait or short-hosted-jobs finding found in several workflows gave the largest workflow's figure
and "the same holds in the others". The evidence now gives each workflow's own figure and
saving, largest first, and marks a workflow timed from only a few successful runs. - No billing claim on a free runner: the timeout finding said a hung run bills every minute
on a public repository too, whose standard hosted runners are free; it now says so only where
the minutes are billed. - One timeout finding: jobs without a working timeout in several workflows are one finding,
naming each job with its workflow, with an example block for each workflow file, instead of one
finding per workflow.
Required checks come from the default branch's rulesets and protection summary, which every
token can read. A pull request's checks are the jobs of each workflow's newest pull request run,
already read for timing when sampled. When something can't be read, nothing is claimed.
Built, tested and packed by publish.yml on this run; the tarball attached here carries a keyless Sigstore build attestation (gh attestation verify <tarball> --owner askalf).