scorecard.yml

# OpenSSF Scorecard maintainer annotations.
#
# The Binary-Artifacts check flags every committed binary as "non-reviewable
# code", because its purpose is to catch generated executables that can drift
# from their source. Our one committed binary is the opposite of that: the Big
# Buck Bunny BD-ROM test fixture (crates/bdinfo-rs/tests/fixtures/BigBuckBunny.iso,
# CC-BY) — a real Blu-ray disc image the end-to-end CI test scans and diffs
# byte-exact against a committed golden report. It is reviewable test data, not
# a generated executable, and removing it would break the cross-platform parse
# guarantee it exists to hold.
#
# The Pinned-Dependencies check flags v-release.yml's `curl … | sh` bootstrap that
# installs cargo-dist on the release runner. That file is generated by cargo-dist
# (the `dist generate --check` gate forbids hand-edits) and cargo-dist offers no
# way to hash-pin its own installer, so the download stays unpinned by hash — but
# it is version-pinned to an immutable release tag (v0.32.0), served from the
# official source over enforced TLS, and the version is drift-guarded against
# dist-workspace.toml. The necessary danger is remediated, not removable.
#
# The Branch-Protection check caps the score at 3/10 because `master` does not
# require pull-request approvers or CODEOWNERS review. That tier is unreachable
# for a single-maintainer project: GitHub forbids approving your own PR, and with
# enforce-admins on there is no bypass, so requiring a reviewer would make every
# merge impossible. Every other protection the check rewards is already on —
# force-push and deletion blocked, required signatures, linear history,
# enforce-admins, strict required status checks, and required conversation
# resolution — so the only unmet requirement is the unattainable second reviewer.
# We decline that one recommendation, not branch protection itself.
#
# Each `reason` records that the finding is accepted; the scorecard-action emits
# it as a SARIF suppression, so code scanning stops raising the alert on future
# runs.
annotations:
  - checks:
      - binary-artifacts
    reasons:
      - reason: test-data
  - checks:
      - pinned-dependencies
    reasons:
      - reason: remediated
  - checks:
      - branch-protection
    reasons:
      - reason: not-supported