diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml index 46cd330..5c33aa3 100644 --- a/.github/workflows/scorecard-enforcer.yml +++ b/.github/workflows/scorecard-enforcer.yml @@ -17,17 +17,24 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true -permissions: read-all +permissions: + contents: read jobs: + # Publish job. The OSSF attestation flow requires that a job invoking + # ossf/scorecard-action with publish_results: true contain ONLY `uses:` + # steps (no `run:`). A `run:` step in this job makes the OSSF publish + # endpoint reject the upload with HTTP 400 ("scorecard job must only have + # steps with `uses`"), failing the whole workflow. Score enforcement is + # therefore split into the separate unprivileged `score-gate` job below. scorecard: runs-on: ubuntu-latest - timeout-minutes: 30 + timeout-minutes: 15 permissions: security-events: write id-token: write # For OIDC steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -39,14 +46,39 @@ jobs: publish_results: true - name: Upload SARIF - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3 + uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4 with: sarif_file: results.sarif + # Unprivileged enforcement gate. Re-derives the score read-only (no + # publish, no id-token), so it may legally contain a `run:` step. + # NOTE: uses JSON output deliberately. The SARIF format does NOT carry the + # aggregate score at .runs[0].tool.driver.properties.score (it is absent + # there, so a SARIF-based gate reads the `// 0` fallback and ALWAYS fails + # the < MIN_SCORE check); the JSON format exposes the aggregate at the + # top-level `.score`. publish_results is false here and does not affect the + # computed score, so enforcement behaviour is unchanged. + score-gate: + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run Scorecard (analysis only) + uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + with: + results_file: results.json + results_format: json + publish_results: false + - name: Check minimum score run: | - # Parse score from results - SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0") + # JSON output carries the aggregate score at the top-level `.score`. + SCORE=$(jq -r '.score // 0' results.json 2>/dev/null || echo "0") echo "OpenSSF Scorecard Score: $SCORE" @@ -61,9 +93,9 @@ jobs: # Check specific high-priority items check-critical: runs-on: ubuntu-latest - timeout-minutes: 30 + timeout-minutes: 15 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Check SECURITY.md exists run: | diff --git a/editors/vscode/README.md b/editors/vscode/README.md index 92026ac..76dfe88 100644 --- a/editors/vscode/README.md +++ b/editors/vscode/README.md @@ -1,4 +1,4 @@ - + # Betlang for Visual Studio Code diff --git a/wiki/Architecture.md b/wiki/Architecture.md index b83410c..c64e96c 100644 --- a/wiki/Architecture.md +++ b/wiki/Architecture.md @@ -1,4 +1,5 @@ + # Architecture diff --git a/wiki/Echo-Types.md b/wiki/Echo-Types.md index 970f81a..532ea98 100644 --- a/wiki/Echo-Types.md +++ b/wiki/Echo-Types.md @@ -1,4 +1,5 @@ + # Echo Types — Structured Loss as a Typed Object diff --git a/wiki/Formal-Verification.md b/wiki/Formal-Verification.md index 885319e..7e76806 100644 --- a/wiki/Formal-Verification.md +++ b/wiki/Formal-Verification.md @@ -1,4 +1,5 @@ + # Formal Verification — and How BetLang Compares diff --git a/wiki/Home.md b/wiki/Home.md index 2512e58..e4197d6 100644 --- a/wiki/Home.md +++ b/wiki/Home.md @@ -1,4 +1,5 @@ + # BetLang Wiki diff --git a/wiki/Number-Tower.md b/wiki/Number-Tower.md index 526c5e4..1f5b68a 100644 --- a/wiki/Number-Tower.md +++ b/wiki/Number-Tower.md @@ -1,4 +1,5 @@ + # The Uncertainty Number Tower diff --git a/wiki/Roadmap.md b/wiki/Roadmap.md index 1ed8758..ef1aff2 100644 --- a/wiki/Roadmap.md +++ b/wiki/Roadmap.md @@ -1,4 +1,5 @@ + # Roadmap diff --git a/wiki/Ternary-Semantics.md b/wiki/Ternary-Semantics.md index 530895f..b688d38 100644 --- a/wiki/Ternary-Semantics.md +++ b/wiki/Ternary-Semantics.md @@ -1,4 +1,5 @@ + # The `bet` Primitive & Ternary Semantics diff --git a/wiki/Type-System.md b/wiki/Type-System.md index da3bc02..fb64015 100644 --- a/wiki/Type-System.md +++ b/wiki/Type-System.md @@ -1,4 +1,5 @@ + # Type System