nordisk/ci-status

runs/scorecard-gunnar/20261029T1732Z-d419ac64/run.json

{
  "pipeline": "scorecard-gunnar",
  "repo": "gunnar",
  "branch": "master",
  "sha": "d419ac648987dd4c44fa256a9f6e46a663d62d8c",
  "trigger": "manual",
  "status": "green",
  "run_id": "explorer-run_pipeline-1793295162689",
  "queued": "",
  "started": "2026-10-29T17:32:42.692530150+00:00",
  "ended": "2026-10-29T17:35:40.057093995+00:00",
  "duration_s": 177,
  "reason": "",
  "dir": "runs/scorecard-gunnar/20261029T1732Z-d419ac64",
  "summary": "OpenSSF Scorecard v5.6.0, local mode, on `gunnar` at `d419ac64`: **5.2 / 10** (the aggregate of the checks local mode runs).\n\n| check | score | reason |\n|---|---|---|\n| Binary-Artifacts | 10 / 10 | no binaries found in the repo |\n| Dangerous-Workflow | 10 / 10 | no dangerous workflow patterns detected |\n| Dependency-Update-Tool | 0 / 10 | no update tool detected |\n| Fuzzing | 0 / 10 | project is not fuzzed |\n| License | 9 / 10 | license file detected |\n| Packaging | inconclusive | packaging workflow not detected |\n| Pinned-Dependencies | 0 / 10 | dependency not pinned by hash detected -- score normalized to 0 |\n| SAST | 0 / 10 | no SAST tool detected |\n| Security-Policy | 10 / 10 | security policy file detected |\n| Token-Permissions | 10 / 10 | GitHub workflow tokens follow principle of least privilege |\n| Vulnerabilities | 0 / 10 | 40 existing vulnerabilities detected |\n\nNot run in local mode (they need a GitHub or GitLab API): Branch-Protection, CI-Tests, CII-Best-Practices, Code-Review, Contributors, Maintained, SBOM, Signed-Releases, Webhooks.\n"
}