Repository navigation
security(scorecard): Token-Permissions alert on scorecard.yml is 19 days stale (CSA001/CSA003) #268
Description
Hypatia code_scanning_alerts CSA001 + CSA003 (both high), surfaced on the #266 scan.
Code scanning (Scorecard):
TokenPermissionsID— Token-Permissions — 19 day(s) old [STALE] at.github/workflows/scorecard.yml(threshold: 7 days) — overdue for remediation.
Assessment (verified): genuine, pre-existing (predates the close-out session), independent of any docs change. CSA001 and CSA003 are the same underlying alert (stale + overdue framings). The ledger classifies scorecard.yml under the billing-wall "pattern B" parking, but least-privilege permissions: hardening (the Token-Permissions remediation) is separate from the billing issue and worth doing on its own.
Disposition: owner governance call. Remediation = pin explicit least-privilege permissions: blocks in .github/workflows/scorecard.yml (and confirm the code-scanning alert clears). Not auto-applied — workflow/security changes are deliberate owner actions.
Source: Hypatia neurosymbolic scan on #266.
Activity
hyperpolymath commentedon Sep 30, 2026
RULING D180 (2026-09-30T14:22Z) · scope: repo · basis: applied-unless-struck (D113; owner approved the full table, none struck)
Yes: pin least-privilege permissions in scorecard.yml (read-all top level, job-scoped writes).
surface: metadatastician/standards#787 (comment)
The open question in this issue is answered by the ruling above; future agents should act on it rather than re-ask.
hyperpolymath commentedon Nov 6, 2026
Resolved by #360, merged as
007d749ec02b3836b45a2183ebbbaf72935c9d91. The explicit least-privilege workflow and refreshed pinned Scorecard caller have now been exercised on main: run42235492211succeeded. GitHub reports the specific Scorecard token-permission alert #149 as fixed (also #11 for Hypatia); neither was manually dismissed. This closes this issue's stale Token-Permissions obligation. The remaining Scorecard review-policy/history, fuzzing and Best Practices findings are separate, retained follow-up work.