Scorecard Code Scanning Snapshot - 2026-05-27

Scope

Repository: Chachamaru127/claude-code-harness

Target: open OSSF Scorecard code scanning alerts after the v4.12.5 release.

Live Inventory

Command:

gh api --method GET \
  repos/Chachamaru127/claude-code-harness/code-scanning/alerts \
  -f state=open

Open alerts before this pass: 13

Alert	Check	Disposition	Evidence / action
#1	Branch-Protection	Fixed in repository settings	main now prevents force pushes and branch deletion. It also requires actionlint, validate, and test-go to pass. GitHub marked the original alert fixed at 2026-05-27T07:22:16Z.
#7-#10	Pinned-Dependencies	Code fix	Removed mutable global npm install/update fallbacks from scripts/quick-install.sh and scripts/check-codex.sh.
#14	SAST	Code fix	Removed CodeQL path filters so CodeQL runs on every main push and every PR targeting main, matching GitHub's CodeQL push/PR/schedule guidance.
#13	Fuzzing	Code fix	Added a Go fuzz target for the user-editable harness.toml parser boundary.
#2-#5	Binary-Artifacts	Annotate / dismiss as intentional payload	The four platform binaries are required for Claude plugin marketplace installs because release assets are not part of the marketplace git-clone payload. tests/test-distribution-archive.sh now requires all shipped platform binaries so accidental removal fails CI.
#12	CII-Best-Practices	Annotate / dismiss as policy defer	The OpenSSF Best Practices badge is an external attestation program. This release line keeps repo-local security gates and records the CII badge as deferred.
#11	Code-Review	Harness policy gate; history-dependent alert remains	This project treats harness-review / Codex companion review approval as the merge review gate. GitHub human-review enforcement is not required because it conflicts with the Harness release flow and self-hosted plugin workflow.

Branch Protection State

Observed after update:

{
  "required_status_checks": {
    "strict": true,
    "contexts": ["actionlint", "validate", "test-go"]
  },
  "enforce_admins": false,
  "required_pull_request_reviews": null,
  "allow_force_pushes": false,
  "allow_deletions": false
}

required_pull_request_reviews stays null intentionally. For this repository, the review gate is Harness review evidence (harness-review / Codex companion review), not GitHub's human-review enforcement. This preserves the intended flow: when Harness review approves and required checks pass, the PR can be merged.

enforce_admins stays false intentionally so release-complete marker commits can still be pushed by an administrator when the release flow needs them.

Verification

bash -n scripts/quick-install.sh scripts/check-codex.sh
git diff --check
python3 - <<'PY'
import yaml
for path in ['scorecard.yml', '.github/workflows/codeql.yml']:
    with open(path, 'r', encoding='utf-8') as f:
        yaml.safe_load(f)
    print(path, 'ok')
PY
bash tests/test-distribution-archive.sh
cd go && go test ./pkg/config
cd go && go test -run '^$' -fuzz=FuzzParseBytes -fuzztime=3s ./pkg/config
cd go && go test ./...
bash tests/validate-plugin.sh
bash scripts/ci/check-consistency.sh

Observed result:

• shell syntax / whitespace: PASS
• YAML parse for scorecard.yml and CodeQL workflow: PASS
• distribution archive check: PASS
• config package tests: PASS
• fuzz smoke: PASS, 1,175,231 execs in the bounded local run
• Go test suite: PASS
• plugin validation: PASS, 95 checks, 0 failures
• consistency check: PASS

External References

• OSSF Scorecard maintainer annotations: https://github.com/ossf/scorecard/blob/main/config/README.md
• OSSF Scorecard checks: https://github.com/ossf/scorecard/blob/main/docs/checks.md
• GitHub CodeQL workflow frequency guidance: https://docs.github.com/en/code-security/reference/code-scanning/workflow-configuration-options
• GitHub branch protection REST API: https://docs.github.com/en/rest/branches/branch-protection