fix: address all 5 OpenSSF Scorecard alerts + Hypatia CI/CD rules#20
Merged
Conversation
Branch-Protection (High): Set required_approving_review_count=1, require_code_owner_reviews=true via GitHub API (already applied). Code-Review (High): Same branch protection change ensures all merges go through reviewed PRs. Maintained (High): Will auto-resolve — recent commits within 90 days. Fuzzing (Medium): Add .github/workflows/fuzz.yml with Zig FFI fuzz targets and MCP bridge input fuzzing (path traversal, oversized input, malformed JSON-RPC). CII-Best-Practices (Low): Requires manual registration at bestpractices.coreinfrastructure.org — noted in Hypatia rules. Also: - Fix scorecard-enforcer SECURITY.md check to look in .github/ and docs/ (not just root) - Update CodeQL to scan both javascript-typescript and actions languages, bump to latest action SHAs - Add .hypatia/scorecard-rules.yml with 9 CI/CD posture rules (branch-protection, code-review, maintained, fuzzing, pinned-deps, cii-best-practices, security-policy, action-sha-pinning, workflow-permissions, spdx-headers) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
4 tasks
hyperpolymath
added a commit
that referenced
this pull request
May 20, 2026
## Summary Re-surveyed all 81 paired cartridges against the freshly-merged iseriser binary (#20 GADT-skip emitter, #21 runtogether candidate, #22 terminal-\`false\` switch-arm tolerance). Allowlist grows from **56 → 66** cartridges. ### Newly clean (+11) — unblocked by iseriser #20/#21/#22 \`chapeliser-mcp\`, \`cloud-mcp\`, \`comms-mcp\`, \`container-mcp\`, \`git-mcp\`, \`gitlab-api-mcp\`, \`ml-mcp\`, \`mongodb-mcp\`, \`queues-mcp\`, \`research-mcp\`, \`vordr-mcp\` ### Newly drifting (-1) — browser-mcp Genuine cartridge-side drift: Idris2 \`BrowserAction.Type\` (Zig candidate \`type\`) vs Zig \`type_text\`. Cartridge-side fix needed, not a verifier defect; not Class B/C/D — filed as out-of-scope. ### Class taxonomy after the fixes | Class | Pre-PR | Post-PR | Status | | --- | --- | --- | --- | | Clean (allowlist) | 56 | **66** | this PR | | Class B (name-norm) | covered | partial | iseriser#21 closed multi-cap acronyms; remaining ums-mcp prefix-stripping is open | | Class C (missing Zig enum) | tracked | tracked | standards#150-155 | | Class D (abbreviation/acronym boundary) | implicit | filed | standards#156 (3 cartridges: postgresql/hetzner/redis) | | Class P (verifier parser limit) | 5 | **0** | iseriser#22 closed | | Class E (malformed Idris2 source) | 1 | **0** | iseriser#20 closed | ## Test plan - [x] Local re-survey on \`origin/main\` snapshot (zero cartridge changes between survey and this PR's base commit) - [x] All 66 cartridges in the new list verified \`abi-verify: OK\` - [x] Removed cartridge (browser-mcp) verified to actually drift - [ ] CI green on this PR (the workflow itself runs the same 66-cartridge check) Refs hyperpolymath/standards#92, hyperpolymath/standards#89, hyperpolymath/iseriser#20, hyperpolymath/iseriser#21, hyperpolymath/iseriser#22. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
fuzz.ymlworkflow — Zig FFI fuzz targets + MCP bridge input fuzzingactionslanguage alongsidejavascript-typescript, bumped action SHAs.github/anddocs/(not just root).hypatia/scorecard-rules.ymlwith 9 CI/CD posture enforcement rulesTest plan
🤖 Generated with Claude Code