v4.6

Images

• ghcr.io/ossf/allstar:v4.6 — minimal image based on scratch
• ghcr.io/ossf/allstar:v4.6-gha — image for use as a GitHub Action

Action Required

• Audit any action policy that mixes deny with allow/require rules across
  priority tiers.

  GHSA-r4gf-cmfp-wq5c means such a policy may have
  been silently permitting what it was configured to deny, for as long as it
  has been in place. Upgrading fixes the ordering going forward, but it does
  not tell you what slipped through — review Allstar's log output or the issues
  it filed for the affected repositories. Policies using only deny rules, only
  allow rules, or a single priority tier were never affected.

• The OpenSSF-hosted Allstar app is retired. Allstar is now self-host only.
  OpenSSF Scorecard's hosted infrastructure moved off GCP because foundation
  GCP funding ended, and the hosted Allstar app ran on it. Organizations that
  installed github.com/apps/allstar-app must now create their own GitHub App
  and run either the GitHub Action or the service daemon; the README's
  installation flow has been restructured around that.

  A newly created app adopts and closes the hosted app's existing
  issues rather than filing duplicates, and your .allstar configuration is
  unchanged. Policy behavior, the config schema, and the .allstar format are
  untouched: this changes how Allstar is obtained and configured, not what it
  does. (#880)

• Operators: KEY_SECRET now defaults to direct, which reads the private
  key from the PRIVATE_KEY environment variable. Compiled-in defaults no
  longer point at the OpenSSF instance's App ID or its Secret Manager path in
  the allstar-ossf GCP project. GCP Secret Manager remains a supported
  backend — only the hardcoded path to OpenSSF's own secret was removed.
  (#880)

• Allstar now exits at startup with an actionable error when APP_ID or
  the private key is missing, instead of attempting to authenticate as an app
  the operator does not own and surfacing GitHub API errors that point nowhere
  near the mistake. Deployments that were relying on the old hosted-instance
  defaults will fail fast rather than fail confusingly. (#880)

• SARIF evidence upload requires a new permission and a redeploy. To use
  the new upload: {sarif: true} Scorecard option, grant your GitHub App the
  Code scanning alerts: Read & write permission (API scope
  security_events) and deploy a new version of your running instance to
  pick it up. This is not among the permissions Allstar otherwise needs.
  (#797)

• Building from source now requires Go 1.25. The go directive moved from
  1.24.0 to 1.25.9 over the course of this release. (see Dependencies)

Highlights

• Fixes GHSA-r4gf-cmfp-wq5c, in which an invalid sort comparator could
  cause action policy deny rules to be silently bypassed depending on the order
  rules appear in the config file. All versions up to and including v4.5 are
  affected. (see Security)
• Scorecard policy results can now be uploaded to GitHub's Code Scanning tab as
  SARIF. (#797, #800)

Features

• Added a -results-file flag that writes Scorecard results in Scorecard JSON
  v2 format, for integration with scorecard-monitor's results-path input.
  (#800)

Security

• GHSA-r4gf-cmfp-wq5c
  — config can silently bypass deny rules. Severity: Low. Affects
  github.com/ossf/allstar <= 4.5; patched in v4.6.

  sortableRules.Less() in the action policy violated the ordering contract
  Go's sort.Interface requires — the comparator returned true for any
  non-deny rule regardless of relative priority, breaking both irreflexivity
  and asymmetry. sort.Sort gives no guarantees for an invalid comparator, so
  rule evaluation order fell out of config file order rather than documented
  rule priority.

  Impact: where a rule group mixed deny with allow/require rules across
  different priority tiers, and a higher-priority deny rule was listed before
  a lower-priority allow rule, the allow rule was evaluated first and
  determined the outcome — the deny rule was never reached. Policies using
  only deny rules, only allow rules, or a single priority tier are unaffected;
  the ordering contract violation cannot fire in those shapes.

  If you cannot upgrade immediately, listing allow/require rules before
  deny rules, or collapsing all rules in a group to one priority tier, avoids
  the trigger — but the first of those relies on an implementation detail of
  the broken comparator and is not a substitute for the fix.

  Reported by @swornim619 and @arpitjain099; remediation by @jeffmendoza;
  coordinated by @justaugustus.

• Hardened the example GitHub Action deployment workflow: least-privilege
  permissions, job timeouts, a concurrency group, quoted shell variables,
  SHA-pinned actions, and persist-credentials: false on checkouts. The
  example moved from examples/gha-allstar-run.yml to
  .github/workflows/allstar.yml so Dependabot/Renovate can track its pinned
  SHAs. (#818)

Dependencies

Direct dependency changes:

Module	From	To
github.com/ossf/scorecard/v5	v5.3.0	v5.5.0
github.com/google/go-github/v74 → /v84	v74.0.0	v84.0.0
github.com/go-git/go-git/v5	v5.16.2	v5.19.2
github.com/bradleyfalzon/ghinstallation/v2	v2.17.0	v2.19.0
github.com/rhysd/actionlint	v1.7.7	v1.7.12
github.com/rs/zerolog	v1.34.0	v1.35.1
github.com/Masterminds/semver/v3	v3.4.0	v3.5.0
gocloud.dev	v0.43.0	v0.46.0
golang.org/x/sync	v0.17.0	v0.22.0

Go directive: 1.24.0 → 1.25.9

Omitted from this list and visible in the v4.5...v4.6 compare:
289 indirect/transitive go.mod changes and the release's GitHub Actions
version bumps, which are SHA-pinned inline across .github/workflows/
rather than in a single manifest.

Internal

• Added deadcode static analysis to CI. (#822, #824)
• The release workflow now generates release notes and creates the GitHub
  Release as a draft for maintainer review before publication, instead of
  publishing immediately with a fixed image list. (#884)

Documentation

• Fixed the Allstar quickstart template link in the README. (#751)

Full Changelog

v4.5...v4.6