Tracks organization-wide adoption of the filtered reusable OSSF Scorecard workflow described in #309. This issue tracks rollout execution only; #309 remains the design and motivation issue.
Implementation:
A repository is checked only after its merged default-branch HEAD has:
- a successful Scorecard push run using the reusable workflow;
- successful
OSSF Scorecard Analysis and Upload to code scanning jobs;
- a retained full
SARIF file artifact and matching public Scorecard publication;
- no open default-branch Scorecard alerts outside
BinaryArtifactsID, DangerousWorkflowID, PinnedDependenciesID, and TokenPermissionsID.
Existing findings from those four retained checks do not block completion. Checklist updates preserve completed rows and never automatically uncheck them.
Status
50 of 79 verified (63%) | inventory refreshed 2026-08-06
| State |
Count |
Meaning |
| Blocked / exception |
0 |
Needs a maintainer decision or has a documented qualification exception |
| In review |
12 |
Upstream PR open (draft = not ready, ready = awaiting maintainers) |
| Merged, awaiting verification |
6 |
Merged; post-merge publication or code-scanning verification remains |
| Verified |
50 |
All post-merge checks passed; row is checked |
| Not started |
11 |
No rollout PR yet |
Rows list owner/repository and available evidence links.
Rollout checklist
Rows are grouped by state and sorted by repository name. Only verified rows are checked, and checked rows are never unchecked automatically.
Blocked or exception
None.
In review
Merged, awaiting verification
Verified
Not started
Exclusions
- open-telemetry/shared-workflows (
.github/workflows/scorecard.yml): owns the reusable workflow
Inventory refreshed 2026-08-06: 79 rollout targets and 1 listed exclusion. Private security forks are omitted from this public tracker. Inventory must be recomputed before each batch.
Tracks organization-wide adoption of the filtered reusable OSSF Scorecard workflow described in #309. This issue tracks rollout execution only; #309 remains the design and motivation issue.
Implementation:
f13d0cb656d7244ca8c1638b6996dbaef1083bddA repository is checked only after its merged default-branch HEAD has:
OSSF Scorecard AnalysisandUpload to code scanningjobs;SARIF fileartifact and matching public Scorecard publication;BinaryArtifactsID,DangerousWorkflowID,PinnedDependenciesID, andTokenPermissionsID.Existing findings from those four retained checks do not block completion. Checklist updates preserve completed rows and never automatically uncheck them.
Status
50 of 79 verified (63%) | inventory refreshed 2026-08-06
draft= not ready,ready= awaiting maintainers)Rows list
owner/repositoryand available evidence links.Rollout checklist
Rows are grouped by state and sorted by repository name. Only verified rows are checked, and checked rows are never unchecked automatically.
Blocked or exception
None.
In review
Merged, awaiting verification
Verified
Not started
Exclusions
.github/workflows/scorecard.yml): owns the reusable workflowInventory refreshed 2026-08-06: 79 rollout targets and 1 listed exclusion. Private security forks are omitted from this public tracker. Inventory must be recomputed before each batch.