Issues

• Pinned-Dependencies skips GitHub Actions referenced through YAML aliases

  kind/bug
  ossf/scorecard#5291 · Filter by author justaugustus opened on Oct 5, 2026 · v5.6.0
  1

• Feature: Packaging check should detect Helm chart publishing workflows

  ossf/scorecard#5288 · Filter by author purisev opened on Oct 4, 2026

• Branch-Protection: recognize the cncf/prow-github-actions review gate (/lgtm + /approve) as a review requirement

  kind/enhancement
  ossf/scorecard#5280 · Filter by author mfahlandt opened on Oct 1, 2026
  2

  

• Feature request: Support Codeberg

  kind/enhancement
  ossf/scorecard#5279 · Filter by author marek22k opened on Oct 1, 2026

• Vulnerable Go deps blocked from patching: docker/docker, moby/buildkit, prometheus/prometheus

  ossf/scorecard#5272 · Filter by author justaugustus opened on Oct 1, 2026

• Release v5.6.0 tracking

  ossf/scorecard#5255 · Filter by author Kielek opened on Sep 29, 2026 · v5.6.0
  1

  

• make install fails during onboarding and CI does not propagate the failure

  kind/bug
  ossf/scorecard#5251 · Filter by author Walentalien opened on Sep 26, 2026

• Do you consider Mutation testing alongside Coverage and Fuzzing?

  ossf/scorecard#5242 · Filter by author AlanGraham opened on Sep 16, 2026
  2

• BUG: unconditional ListCommits makes Scorecard unusable with a GitHub App installation token

  ossf/scorecard#5214 · Filter by author corbin-infonetica opened on Sep 3, 2026
  2

• [IMPORTANT] Scorecard Infrastructure Changes

  ossf/scorecard#5208 · Filter by author justaugustus opened on Aug 30, 2026
  9

  

• PinnedDependenciesID should recognize GitHub actions.lock enforcement

  needs triage
  ossf/scorecard#5207 · Filter by author hyperpolymath opened on Aug 29, 2026
  2

• BUG: Code-Review treats any merged PR with an approved/lgtm label as reviewed, ignoring the PR's actual reviews

  needs triage
  ossf/scorecard#5206 · Filter by author mapyr opened on Aug 29, 2026
  2

• Packaging check does not recognize GitHub CLI and Nextcloud App Store publishing workflows

  needs triage
  ossf/scorecard#5201 · Filter by author Dennis-Otto opened on Aug 27, 2026

• BUG: Security-Policy scores the contents of an unrelated security.md found elsewhere in the tree

  needs triage
  ossf/scorecard#5198 · Filter by author tufantunc opened on Aug 25, 2026
  1

• Go fuzz build fails with GOMODCACHE overlay

  kind/bug
  ossf/scorecard#5193 · Filter by author xingyaner opened on Aug 23, 2026
  1

• Packaging check should recognize gh release create workflows

  needs triage
  ossf/scorecard#5188 · Filter by author JacbK opened on Aug 18, 2026
  1

• BUG: Token-Permissions ignores packages: write for non-GitHub publishing workflows

  kind/bugneeds triage
  ossf/scorecard#5170 · Filter by author ECD5A opened on Aug 10, 2026
  2

• Feature: Packaging check should detect winget publishing workflows

  needs triage
  ossf/scorecard#5168 · Filter by author mangokingTW opened on Aug 9, 2026
  4

• Feature --local needs --exclude or similar mechanism to allow excluding directories from the analysis

  kind/enhancementneeds triage
  ossf/scorecard#5162 · Filter by author BarrySmith opened on Aug 4, 2026
  1

• BUG: CI-Tests misses successful CI when checkSuites exceed the first 30

  needs triage
  ossf/scorecard#5149 · Filter by author oaslananka opened on Jul 30, 2026
  1

• Feature: Packaging check should detect cargo-dist (axodotdev) Rust release workflows

  needs triageStale
  ossf/scorecard#5145 · Filter by author SebTardif opened on Jul 27, 2026
  1

• BUG: Packaging check's ko matcher requires BOTH setup-ko spellings in one job, so ko publishing is never detected

  needs triage
  ossf/scorecard#5133 · Filter by author arcaven opened on Jul 17, 2026
  2

• Feature: Packaging check should detect step-security/goreleaser-action (maintained fork of goreleaser/goreleaser-action)

  needs triageStale
  ossf/scorecard#5131 · Filter by author arcaven opened on Jul 17, 2026
  2

• Feature: Add winget package manager support

  kind/enhancement
  ossf/scorecard#5100 · Filter by author andy778 opened on Jun 21, 2026
  5

• Feature: Support changesets for the Packaging check

  Stale
  ossf/scorecard#5096 · Filter by author gr2m opened on Jun 16, 2026
  2