Martin BallandClaude Opus 5.5 5b5810fe1f CI: Scorecard hardening — release token write only on the release job, SECURITY.md, patched ctutils (#4975) ...

OpenSSF Scorecard (v5.6.0, 4.0/10) flagged:
- Token-Permissions: release.yml granted contents: write at the top level.
  Now read at the top, write on the release job only (same effective access).
- Security-Policy: no SECURITY.md. Added one pointing to GitHub private
  vulnerability reporting (already enabled on the repo).
- Vulnerabilities: ctutils 0.4.3 -> 0.4.7 (RUSTSEC-2026-0385); clipboard-win
  5.4.1 -> 5.4.3 (yanked).

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-30 13:00:27 -04:00

..

ci.yml

Release and CI: the suite's craft-fonts pin (bfcbf714, the same fonts as a71c20e) instead of an app override (#3888)

2026-10-24 21:05:19 +00:00

freebsd.yml

Release and CI: the suite's craft-fonts pin (bfcbf714, the same fonts as a71c20e) instead of an app override (#3888)

2026-10-24 21:05:19 +00:00

nix.yml

ci: switch to shared nix workflow from craft-common-actions

2026-10-15 23:57:51 -04:00

packaging-lint.yml

fix(installer): harden install-policy checks and packaging-lint workflow

2026-10-27 12:02:00 +00:00

printing.yml

ci(deps): bump Swatinem/rust-cache

2026-10-23 18:53:02 +00:00

release.yml

CI: Scorecard hardening — release token write only on the release job, SECURITY.md, patched ctutils (#4975)

2026-10-30 13:00:27 -04:00

sonarcloud.yml

ci(sonar): don't cancel superseded runs on main, so coverage is published (#4070)

2026-10-23 17:01:48 -04:00

windows-arm64.yml

CI: workflows only call craft-common-actions at @main (#4919)

2026-10-29 22:17:20 -04:00