OpenSSF ScoreCard plugin scans the repo's GitHub Actions workflows for language-specific publishing actions/steps that push a build artifact to a package registry (e.g., an npm publish step, a PyPI upload action, Maven Central deploy, etc.). Scorecard's own docs admit this makes it a heuristic: absence of a detected publishing workflow doesn't prove the project isn't packaged, only that Scorecard couldn't find automated evidence of it.
For example, it fails to detect this gammapy publication workflow because it's not using a workflow in Scorecard's allowlist (which only knows about pypa/gh-action-pypi-publish, relekang/python-semantic-release, actions/setup-node+npm, maven/gradle, cargo, nuget, docker, goreleaser, etc.).
This raises the question of how we select plugins and how we treat them.
Here, failing that test should not fail the indicator, only the contrary : passing the test validates the indicator.
I think this could be linked to the discussion about meta-plugins #106. Some indicators should be validated by a set of tools with a logical OR to improve the usefulness and trustability of the check.
OpenSSF ScoreCard plugin scans the repo's GitHub Actions workflows for language-specific publishing actions/steps that push a build artifact to a package registry (e.g., an npm publish step, a PyPI upload action, Maven Central deploy, etc.). Scorecard's own docs admit this makes it a heuristic: absence of a detected publishing workflow doesn't prove the project isn't packaged, only that Scorecard couldn't find automated evidence of it.
For example, it fails to detect this gammapy publication workflow because it's not using a workflow in Scorecard's allowlist (which only knows about pypa/gh-action-pypi-publish, relekang/python-semantic-release, actions/setup-node+npm, maven/gradle, cargo, nuget, docker, goreleaser, etc.).
This raises the question of how we select plugins and how we treat them.
Here, failing that test should not fail the indicator, only the contrary : passing the test validates the indicator.
I think this could be linked to the discussion about meta-plugins #106. Some indicators should be validated by a set of tools with a logical OR to improve the usefulness and trustability of the check.