From 68f51d949554bd21b3153be23d7fb7a381c77163 Mon Sep 17 00:00:00 2001 From: Ryan Hill Date: Tue, 25 Aug 2026 07:57:16 -0500 Subject: [PATCH] ci: drop contents and actions read from the scorecard job Both are private-repository permissions and this repo is public. The only Actions API call Scorecard makes is ListWorkflowRunsByFileName, from the Packaging and Binary-Artifacts checks. That endpoint is publicly readable: requesting it for a public repo with no authentication at all returns 200. Upstream's starter workflow ships `contents: read` and `actions: read` commented out under "uncomment if installing in a private repository", and OSSF runs Scorecard on its own public repos -- ossf/scorecard and ossf/scorecard-action -- with `security-events: write` and `id-token: write` alone. Those runs are green and score Packaging 10, Binary-Artifacts 10 and CI-Tests 10, which is the same evidence for dropping `contents: read`: their checkout step works without it. Follows #94, which merged before this was raised in review on qBraid/pyqasm#412. --- .github/workflows/scorecard.yml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 4299c70..ed56174 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -27,11 +27,9 @@ jobs: permissions: security-events: write # upload SARIF to code scanning id-token: write # publish results to the public Scorecard API - contents: read - # Lets Scorecard read workflow definitions and run history. Documented by the - # upstream starter workflow as required for private repositories; this repo is - # public, so it is retained only as a safeguard should that ever change. - actions: read + # `contents: read` and `actions: read` are deliberately absent. Upstream ships both + # commented out, needed only for private repositories, and OSSF runs Scorecard on its + # own public repos with exactly the two permissions above. # Actions are pinned to full commit SHAs: a tag is mutable and can be repointed at # other code, which is what Scorecard's own Pinned-Dependencies check looks for.