From cb4c63e7a44468eb5bd72fe7cdd3b7b1d6144000 Mon Sep 17 00:00:00 2001 From: KyleVorster7 <108583489+KyleVorster7@users.noreply.github.com> Date: Thu, 13 Aug 2026 21:36:24 +0200 Subject: [PATCH] docs: turn off private-rule Code Security scanning Signed-off-by: KyleVorster7 <108583489+KyleVorster7@users.noreply.github.com> --- .github/workflows/sync-workflows.yml | 12 ++++++++++ README.md | 33 ++++++++++++++++++++++++---- workflow-docs/njsscan.md | 4 +++- workflow-docs/scorecard.md | 6 ++++- workflow-docs/sync-workflows.md | 2 ++ 5 files changed, 51 insertions(+), 6 deletions(-) diff --git a/.github/workflows/sync-workflows.yml b/.github/workflows/sync-workflows.yml index 57f631d..46a8cdf 100644 --- a/.github/workflows/sync-workflows.yml +++ b/.github/workflows/sync-workflows.yml @@ -132,6 +132,11 @@ jobs: rm -f temp-workflows/release.yml rm -f temp-workflows/release-train.yml rm -f temp-workflows/release-orchestrator.yml + # Private frmscoe rule repos: no dedicated Code Security scanning. + # SARIF uploads (njsscan / Scorecard) stay on public tazama-lf rule-901/902. + # See README "Decision: no dedicated Code Security scanning on private frmscoe rule repos". + rm -f temp-workflows/njsscan.yml + rm -f temp-workflows/scorecard.yml for repo in $REPOS; do git clone https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/frmscoe/$repo.git @@ -169,6 +174,10 @@ jobs: if [[ "${filename}" == "publish.yml" || "${filename}" == "version-check.yml" || "${filename}" == "release-train.yml" ]]; then continue fi + # njsscan / scorecard: not distributed to private frmscoe rules (README decision) + if [[ "${filename}" == "njsscan.yml" || "${filename}" == "scorecard.yml" ]]; then + continue + fi cp -r "$file" "$repo/.github/workflows/" done @@ -215,6 +224,9 @@ jobs: cp "${WORKFLOWS_ROOT}/config-templates/.codacy.yml" ".codacy.yml" # Remove legacy dco-check.yaml (wrong extension - canonical is dco-check.yml) rm -f .github/workflows/dco-check.yaml + # Drop private-repo Code Security scanners if still present from older syncs + rm -f .github/workflows/njsscan.yml + rm -f .github/workflows/scorecard.yml git add -A .github/workflows/ .codacy.yml git commit -m "ci: sync workflows from central-workflows [skip ci]" -m "${SIGNED_OFF_BY}" || echo "No changes to commit" git push origin sync-workflows-update || git push origin sync-workflows-update --force diff --git a/README.md b/README.md index c3ab4c8..f9ef385 100644 --- a/README.md +++ b/README.md @@ -51,11 +51,36 @@ tazama-lf/workflows → (manual PR) → frmscoe/workflows → (auto sync o All 33 rule repos receive: -`branch-target-check.yml`, `codacy.yml`, `codeql.yml`, `conventional-commits.yml`, `dco-check.yml`, `dependency-review.yml`, `gpg-verify.yml`, `milestone.yml`, `njsscan.yml`, `node.js.yml` (caller stub), `publish.yml`, `release-train.yml`, `release.yml`, `sbom.yml`, `scorecard.yml`, `version-check.yml` +`branch-target-check.yml`, `codacy.yml`, `codeql.yml`, `conventional-commits.yml`, `dco-check.yml`, `dependency-review.yml`, `gpg-verify.yml`, `node.js.yml` (caller stub), `sbom.yml` Plus per-repo caller stubs for: `package-rule-rc.yml` (fires on `push: dev`) and `package-rule.yml` (fires on `push: main`) -**Not distributed:** `sync-workflows.yml`, `node-ci.yml` (reusable workflow stays in this repo; consumer repos reference it at runtime via `@dev` ref), `package-rule*.yml` canonical reusable definitions (replaced with caller stubs) +**Not distributed:** `sync-workflows.yml`, `node-ci.yml` (reusable workflow stays in this repo; consumer repos reference it at runtime via `@dev` ref), `package-rule*.yml` canonical reusable definitions (replaced with caller stubs), `dev-to-main-pr.yml` / `publish.yml` / `release*.yml` / `version-check.yml` (library or central-only), `njsscan.yml`, `scorecard.yml` (see decision below) + +--- + +## Decision: no dedicated Code Security scanning on private frmscoe rule repos + +**Date:** August 2026 + +**Context:** `njsscan` and Scorecard upload SARIF into GitHub Code scanning. On private and internal repos that needs paid [GitHub Code Security](https://docs.github.com/en/billing/concepts/product-billing/github-advanced-security) (list price about $30 per unique 90-day active committer / month). Enablement on private `frmscoe` rule repos is locked by a billing issue, so those jobs fail without producing a usable dashboard. + +**Decision:** Do **not** run dedicated billable code-scanning workflows (`njsscan.yml`, `scorecard.yml`) on the private `frmscoe` rule repos. Keep that scanning on the **public** reference rules instead: + +- [`tazama-lf/rule-901`](https://github.com/tazama-lf/rule-901) (already has `njsscan.yml`; Scorecard added separately) +- [`tazama-lf/rule-902`](https://github.com/tazama-lf/rule-902) (same) + +Fixes and findings picked up on those public repos are expected to propagate into the `frmscoe` rules through the normal central-workflow / release path. Paying for Code Security on every private rule repo is not required for that model. + +**What we changed here:** + +1. Documented this decision in this README. +2. Stopped syncing `njsscan.yml` and `scorecard.yml` to the 33 private rule repos, and remove those files on sync if they are still present. +3. Left the workflow definitions in this repo for reference / possible use on public surfaces. They are no longer part of the private-rule sync bundle. + +**Out of scope for this decision:** CodeQL and Codacy also use SARIF upload and can hit the same Code Security lock on private repos. They were not removed here. Revisit if they stay red for the same billing reason. + +**Related:** [tazama-lf/workflows#66](https://github.com/tazama-lf/workflows/issues/66) (CodeQL Action v3 → v4) is separate hygiene and does not unblock private-repo SARIF while Code Security is locked. --- @@ -81,7 +106,7 @@ Individual workflow documentation is in [`workflow-docs/`](workflow-docs/). For | [`dockerhub-image-build.md`](workflow-docs/dockerhub-image-build.md) | Not in frmscoe/workflows | | [`gpg-verify.md`](workflow-docs/gpg-verify.md) | → tazama-lf docs | | [`milestone.md`](workflow-docs/milestone.md) | → tazama-lf docs | -| [`njsscan.md`](workflow-docs/njsscan.md) | → tazama-lf docs | +| [`njsscan.md`](workflow-docs/njsscan.md) | Not synced to private frmscoe rules (public rule-901/902) | | [`node-ci.md`](workflow-docs/node-ci.md) | frmscoe-specific (`NPM_SCOPE=@frmscoe`) | | [`nodejs.md`](workflow-docs/nodejs.md) | → tazama-lf docs | | [`package-rule-rc.md`](workflow-docs/package-rule-rc.md) | frmscoe-specific | @@ -90,7 +115,7 @@ Individual workflow documentation is in [`workflow-docs/`](workflow-docs/). For | [`release-train.md`](workflow-docs/release-train.md) | → tazama-lf docs | | [`release.md`](workflow-docs/release.md) | → tazama-lf docs | | [`sbom.md`](workflow-docs/sbom.md) | → tazama-lf docs (⚠️ known issue [#39](https://github.com/tazama-lf/workflows/issues/39)) | -| [`scorecard.md`](workflow-docs/scorecard.md) | → tazama-lf docs | +| [`scorecard.md`](workflow-docs/scorecard.md) | Not synced to private frmscoe rules (public rule-901/902) | | [`sync-workflows.md`](workflow-docs/sync-workflows.md) | frmscoe-specific | | [`version-check.md`](workflow-docs/version-check.md) | → tazama-lf docs | diff --git a/workflow-docs/njsscan.md b/workflow-docs/njsscan.md index 59dd4bc..d5b8dee 100644 --- a/workflow-docs/njsscan.md +++ b/workflow-docs/njsscan.md @@ -6,4 +6,6 @@ ## frmscoe-specific notes -_None - behaviour in `frmscoe` rule repos is identical to the canonical workflow._ +**Not distributed to private `frmscoe` rule repos.** SARIF upload needs GitHub Code Security on private repos (billable). Decision: keep Node security scanning on the public reference rules [`tazama-lf/rule-901`](https://github.com/tazama-lf/rule-901) and [`tazama-lf/rule-902`](https://github.com/tazama-lf/rule-902), and propagate fixes through the normal central-workflow path. See the README section *Decision: no dedicated Code Security scanning on private frmscoe rule repos*. + +The caller stub and `njsscan-ci.yml` remain in this repo for reference. `sync-workflows.yml` excludes them from the private-rule bundle and removes leftover copies on sync. diff --git a/workflow-docs/scorecard.md b/workflow-docs/scorecard.md index 1e6b328..d1b7a16 100644 --- a/workflow-docs/scorecard.md +++ b/workflow-docs/scorecard.md @@ -79,4 +79,8 @@ None (uses GitHub OIDC token via `id-token: write`). | Repository | Reason | |-----------|--------| -| _(none)_ | _(all synced service repos use the canonical version)_ | +| All private `frmscoe` rule repos | **Not synced.** Scorecard SARIF upload needs Code Security on private repos. Scanning stays on public `tazama-lf/rule-901` and `rule-902`. See README decision. | + +## frmscoe-specific notes + +`sync-workflows.yml` excludes `scorecard.yml` from the private-rule bundle and deletes leftover copies on sync. The file may still exist in this central repo for reference. diff --git a/workflow-docs/sync-workflows.md b/workflow-docs/sync-workflows.md index ff9ed1f..38fc62e 100644 --- a/workflow-docs/sync-workflows.md +++ b/workflow-docs/sync-workflows.md @@ -70,6 +70,8 @@ Propagates canonical workflow files and the standard `.codacy.yml` engine allowl | `sync-workflows.yml` | Canonical-only; never distributed | | `node-ci.yml` | Reusable workflow; consumer repos reference it at runtime via `@dev` | | `package-rule*.yml` (canonical definitions) | Replaced with per-repo caller stubs (see above) | +| `njsscan.yml` | Not for private frmscoe rules; Code Security billable. Keep on public `tazama-lf/rule-901` / `rule-902` | +| `scorecard.yml` | Same as njsscan; also removed from targets on sync if still present | ---