chore: add OpenSSF Scorecard workflow - #4
Conversation
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 19 minutes and 10 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
CodeAnt AI is reviewing your PR. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: Push trigger references nonexistent main branch
- Changed the push trigger branch from 'main' to 'master' to match the repository's actual default branch.
You can send follow-ups to the cloud agent here.
Reviewed by Cursor Bugbot for commit a84371f. Configure here.
| schedule: | ||
| - cron: '17 3 * * 6' | ||
| push: | ||
| branches: [main] |
There was a problem hiding this comment.
Push trigger references nonexistent main branch
Medium Severity
The push trigger filters on branches: [main], but this repository's default branch is master (as seen in codeql.yml, check-version.yml, and other workflows). As a result, the push trigger will never fire and Scorecard will only run on the weekly cron and branch_protection_rule events, delaying detection of regressions until the next scheduled run.
Reviewed by Cursor Bugbot for commit a84371f. Configure here.
|
CodeAnt AI finished reviewing your PR. |
|
User description
Audit makeplane#256 fleet standardization. Adds OpenSSF Scorecard analysis workflow.
First Scorecard run will take ~1 week before results appear in OpenSSF database — that's expected indexing latency, not a bug.
Note
Low Risk
Low risk: adds a new GitHub Actions security scanning workflow and SARIF upload with limited, job-scoped permissions; no application runtime code changes.
Overview
Adds a new GitHub Actions workflow (
.github/workflows/scorecard.yml) to run OpenSSF Scorecard onmainpushes, branch protection rule events, and a weekly schedule.The job runs
ossf/scorecard-actionand uploads the generated SARIF both as a short-lived artifact and to GitHub code scanning viaupload-sarif, usingsecurity-events: writeandid-token: writejob permissions.Reviewed by Cursor Bugbot for commit a84371f. Bugbot is set up for automated code reviews on this repo. Configure here.
CodeAnt-AI Description
Add automated OpenSSF Scorecard checks
What Changed
Impact
✅ Earlier security findings✅ Ongoing repository health checks✅ Easier review of Scorecard results🔄 Retrigger CodeAnt AI Review
Details
💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.