💡 Unified Security Posture Dashboard & Cross-Scanner Trend Tracking

[github-actions[bot]]

Summary

The org runs 3+ security scanners (OpenSSF Scorecard, SonarCloud, CodeQL) plus AI code review tools across 5 repos, generating findings tracked separately with no unified view. This proposal creates a scheduled workflow that aggregates security scores, finding counts, and remediation trends into a single summary, enabling cross-scanner prioritization and org-wide security posture trending.

Market Signal

The security tooling market is consolidating around unified dashboards — Snyk, Mend, and Wiz all offer multi-scanner aggregation views. OpenSSF Scorecard v5.5.0 (April 2026) improved check accuracy and now runs billions of evaluations monthly. GitHub's code scanning dashboard aggregates CodeQL and SARIF sources but does not include Scorecard or SonarCloud. The gap between "many scanners, no single view" is a recognized DevSecOps pain point across the industry.

User Signal

• 5 open Scorecard findings: Pinned-Dependencies 7/10 (Scorecard: Pinned-Dependencies (7/10) #726), Token-Permissions 7/10 (Scorecard: Token-Permissions (7/10) #318), Security-Policy 0/10 (Scorecard: Security-Policy (0/10) #317), License 0/10 (Scorecard: License (0/10) #315), Branch-Protection 8/10 (Scorecard: Branch-Protection (8/10) #313)
• SonarCloud debt reduction is an active initiative (Initiative: SonarCloud org-wide debt reduction & rule tuning #593) with 18+ remaining S7635 findings (SonarCloud: resolve remaining S7635 secrets-inherit stubs (×18) #600) and 13+ dependency hardening findings (SonarCloud: GitHub Actions / dependency hardening (×13) #598)
• Recent remediation PRs (feat(release): pinned-version report — Safe Release SC8 (#502) #724, docs: add MIT LICENSE (Scorecard License) #728, ci: scope workflow GITHUB_TOKEN permissions (Scorecard Token-Permissions) #729, feat: implement issue #623 — SonarCloud: GitHub Actions / dependency hardening #723) show active but uncoordinated investment across scanners — fixes happen reactively, not prioritized by cross-scanner severity

Technical Opportunity

OpenSSF Scorecard already runs as a scheduled GitHub Action with SARIF output. SonarCloud findings are queryable via API. CodeQL results are accessible through the code scanning API. The compliance-audit workflow already queries multiple data sources — extending that pattern to aggregate security scanner results is architecturally consistent. The daily Org Status issue (#751) provides a proven template for automated reporting.

Assessment

Dimension	Score	Rationale
Feasibility	med	Requires API integration with 3 scanners; no new tooling needed
Impact	high	Enables cross-scanner prioritization; replaces 3+ manual dashboard checks
Urgency	med	Active remediation work is happening now without unified prioritization

Adversarial Review

Strongest objection: Dashboard fatigue — the org already has daily Org Status issues, fleet monitoring, compliance audits, and canary telemetry. Adding another reporting surface risks being ignored.

Rebuttal: The value is in cross-scanner prioritization, not just visibility. When you have a SonarCloud MAJOR finding and a Scorecard 0/10, which do you fix first? Today that requires checking 3 different dashboards. A unified trend view shows which scanner produces the most actionable findings and whether overall posture is improving or degrading. It replaces multiple manual checks rather than adding to them. The weekly cadence (vs. daily for Org Status) keeps the signal-to-noise ratio manageable.

Suggested Next Step

Prototype a scheduled workflow that runs weekly, queries Scorecard (via scorecard-action), SonarCloud (via API), and CodeQL (via code scanning API), and writes a summary to GITHUB_STEP_SUMMARY. If valuable, extend to a GitHub Projects board with per-repo tracking.