Repository navigation
ci: keep the workflow hardening in place with a Plumber check and badge - #9944
Open
Totara-thib wants to merge 1 commit into
Open
Totara-thib wants to merge 1 commit into
Totara-thib wants to merge 1 commit into
Conversation
Totara-thib
requested review from
blessedcoolant,
joshistoast and
lstein
as code owners
October 19, 2026 11:44
github-actions
Bot
added
CI-CD
Totara-thib
force-pushed
the
plumber-score
branch
from
October 19, 2026 11:57
9a3bf45 to
cdec2ce
Compare
A small workflow runs the Plumber CLI on pushes to main and on pull requests. It checks the GitHub workflows for the classes of findings the previous commits fixed (floating action refs, missing permissions) and fails under 85 points, so one small finding never blocks a pull request. The overlay keeps the built-in defaults, trusts the eight runner, change-detection and release actions this repository uses pinned by commit, and keeps the branch protection requirement on main rather than the frozen release/* branches. The README gets the score badge under the sponsor badge.
Totara-thib
force-pushed
the
plumber-score
branch
from
October 20, 2026 14:45
cdec2ce to
5f2cc9a
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follows up on #9842, merged earlier.
A small workflow now runs the Plumber CLI on pushes to main and on pull requests. It checks the workflows for the classes #9842 fixed, floating action refs, missing permissions and checkouts that keep the token, and fails under 85 points, so one small finding never blocks a PR. The
.plumber.yamloverlay keeps the built-in defaults and records this repository's own choices: the eight runner, change-detection and release actions it trusts on top of the defaults, and the protection requirement on main rather than the eighteen frozen release branches.Score badge
Every run publishes the score, like OpenSSF Scorecard's results. The badge shows main, a failed publish never fails your CI, no token or secret is needed. It reads UNKNOWN until the first run on main. Removing the
score-pushline is the whole opt-out if you want the check without the badge.Related Issues / Discussions
#9842 (merged).
QA Instructions
Plumber on this branch merged with main: A 100/100, zero findings. Workflow, overlay and README only.
Review
No material findings.
Checklist
What's Newcopy (if doing a release after this PR)I work on Plumber. If you do not want the tool, no hard feelings, say so and I close this PR, the hardening stands on its own.
Need help on this PR? Tag
@codesmith-botwith what you need.