p4gs/sscsb-action

C provisional

https://github.com/p4gs/sscsb-action · scanned 2026-09-02 at 3f78b87de7b8 on main · sscsb 0.3.0 · methodology v1 · scan run · authenticated

Overall: 70% · evidence coverage: 66.7% · provisional

verified needs attention unverified — outside the math

Raw sscsb verdicts and every reclassification are shown — transparency about what was and wasn't verifiable is the product.

Phase 1 — Commit integrity

4 pass · 0 fail/gap · 5 unverified

100%

Pass
secrets raw: degraded
runner-tool availability is the scanner's environment, not the repository's; all registered artifacts pre-exist
evidence
- pre-commit + commit-msg + pre-push shims installed, executable, and unmodified (core.hooksPath=.sscsb/hooks)
- trufflehog not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 3.95.9. Install: brew install trufflehog (Linuxbrew) or see Release binaries: https://github.com/trufflesecurity/trufflehog/releases (https://github.com/trufflesecurity/trufflehog)
- gitleaks not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 8.30.1. Install: brew install gitleaks (Linuxbrew) or see Release binaries: https://github.com/gitleaks/gitleaks/releases (https://github.com/gitleaks/gitleaks)
Unverified
commit-signing raw: pass
requires the local development environment; not observable in a repository scan
evidence
- pre-commit + commit-msg + pre-push shims installed, executable, and unmodified (core.hooksPath=.sscsb/hooks)
- 1 approved signer(s), 1 human
- git config `gpg.format` unset — see docs/signing.md for YubiKey ed25519-sk setup
- git config `user.signingkey` unset — see docs/signing.md for YubiKey ed25519-sk setup
- git config `commit.gpgSign` unset — see docs/signing.md for YubiKey ed25519-sk setup
Info
agent-signing out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Unverified
signing-model raw: degraded
requires the local development environment; not observable in a repository scan
evidence
- human-local: incomplete — run `sscsb signing setup human-local`
- agent-claude-code: incomplete — run `sscsb signing setup agent-claude-code`
- cloud-claude: repo-side attribution is probeable and is not in place — an attestation cannot stand in for it
- cloud-claude: github_app_installed: not attested — `sscsb signing setup cloud-claude --confirm`
- github-web: vigilant_mode: not attested — `sscsb signing setup github-web --confirm`
- github-web: phishing_resistant_mfa: not attested — `sscsb signing setup github-web --confirm`
- codespaces: gpg_verification: not attested — `sscsb signing setup codespaces --confirm`
Pass
branch-protection
evidence
- main: required pull requests ✓
- main: force-push blocking ✓
- main: required signed commits ✓
- main: required status checks ✓
- main: deletion protection ✓
- main: Scorecard — stale-review dismissal ✓
- main: Scorecard gap — ≥1 required approving review off (needs a 2nd reviewer; a solo maintainer cannot self-approve — opt in with `sscsb harden branch-protection --require-reviews` once you have one)
- main: Scorecard gap — code-owner review off (needs a 2nd reviewer; a solo maintainer cannot self-approve — opt in with `sscsb harden branch-protection --require-reviews` once you have one)
Pass
actions-audit
evidence
- all workflows pass (SHA-pinned, least-privilege)
Info
gittuf out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Unverified
ai-trailers raw: pass
requires the local development environment; not observable in a repository scan
evidence
- enforced by the commit-msg hook
- pre-commit + commit-msg + pre-push shims installed, executable, and unmodified (core.hooksPath=.sscsb/hooks)
Unverified
ai-dep-gate raw: pass
requires the local development environment; not observable in a repository scan
evidence
- enforced by the commit-msg hook
- pre-commit + commit-msg + pre-push shims installed, executable, and unmodified (core.hooksPath=.sscsb/hooks)
Pass
pr-template
evidence
- AI-provenance PR template installed (code/tests/deps/docs questions)
Unverified
ai-receipts raw: degraded
requires the local development environment; not observable in a repository scan
evidence
- receipts: `sscsb receipt create [commit]` → .sscsb/out/receipts/, `sscsb receipt verify <file>` recomputes the patch digest, re-reads the commit's AI trailers, and verifies any cosign bundle beside the receipt
- cosign not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 3.1.1. Install: brew install cosign (Linuxbrew) or see Release binaries: https://github.com/sigstore/cosign/releases (https://github.com/sigstore/cosign)

Phase 2 — Dependencies & SBOM

3 pass · 0 fail/gap · 4 unverified

100%

Pass
sbom raw: degraded
runner-tool availability is the scanner's environment, not the repository's; all registered artifacts pre-exist
evidence
- syft not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 1.46.0. Install: brew install syft (Linuxbrew) or see Release binaries: https://github.com/anchore/syft/releases (https://github.com/anchore/syft)
Pass
vuln-scan raw: degraded
runner-tool availability is the scanner's environment, not the repository's; all registered artifacts pre-exist
evidence
- trivy not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 0.72.0. Install: brew install trivy (Linuxbrew) or see Release binaries: https://github.com/aquasecurity/trivy/releases (https://github.com/aquasecurity/trivy)
- osv-scanner not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 2.4.0. Install: brew install osv-scanner (Linuxbrew) or see Release binaries: https://github.com/google/osv-scanner/releases (https://github.com/google/osv-scanner)
Unverified
scorecard raw: degraded
evidence
- .github/workflows/scorecard.yml installed
- live Scorecard results could not be read (none published yet — the workflow runs on push to the default branch — or the code-scanning API refused) — posture unverified
Pass
renovate
evidence
- renovate.json5 installed (7 key(s))
Unverified
package-trust raw: pass
requires the local development environment; not observable in a repository scan
evidence
- new-package approval gate enforced in commit-msg hook
- pre-commit + commit-msg + pre-push shims installed, executable, and unmodified (core.hooksPath=.sscsb/hooks)
- approved baseline present (0 package(s))
- registry existence validation ON for `sscsb deps check` and approvals (anti-slopsquat)
- typosquat proximity heuristic ON for `sscsb deps check`, approvals, and the commit gate
Unverified
bumblebee raw: degraded
requires the local development environment; not observable in a repository scan
evidence
- bumblebee not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 0.1.2. Install: brew install bumblebee (Linuxbrew) or see Read-only endpoint inventory scanner (Go, zero dependencies). Release binaries: https://github.com/perplexityai/bumblebee/releases — exposur…
Unverified
grype raw: degraded
requires the local development environment; not observable in a repository scan
evidence
- grype not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 0.115.0. Install: brew install grype (Linuxbrew) or see Release binaries: https://github.com/anchore/grype/releases (https://github.com/anchore/grype)
Info
socket-firewall out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml

Phase 3 — Provenance

1 pass · 6 fail/gap · 0 unverified

14.3%

Gap
sigstore-signing raw: disabled
evidence installed by the scanner's own init (.github/workflows/release-sign.yml) — absent from the repository
evidence
- disabled in .sscsb/config.toml
Gap
slsa-provenance raw: disabled
evidence installed by the scanner's own init (.github/workflows/release-slsa.yml) — absent from the repository
evidence
- disabled in .sscsb/config.toml
Gap
github-attestations raw: disabled
evidence installed by the scanner's own init (.github/workflows/release-attest.yml) — absent from the repository
evidence
- disabled in .sscsb/config.toml
Gap
sbom-attestation raw: disabled
evidence installed by the scanner's own init (.github/workflows/release-attest-sbom.yml) — absent from the repository
evidence
- disabled in .sscsb/config.toml
Info
model-signing out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Gap
provenance-verify raw: disabled
evidence installed by the scanner's own init (.github/workflows/deploy-gate.yml) — absent from the repository
evidence
- disabled in .sscsb/config.toml
Info
release-immutability out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Gap
octo-sts raw: disabled
evidence installed by the scanner's own init (.github/workflows/octo-sts-example.yml, .github/chainguard/sscsb-automation.sts.yaml) — absent from the repository
evidence
- disabled in .sscsb/config.toml
Pass
harden-runner
evidence
- ci.yml: harden-runner present in job `self-test`
- codeql.yml: harden-runner present in job `analyze`
- sast-opengrep.yml: harden-runner present in job `opengrep`
- sbom.yml: harden-runner present in job `sbom`
- scorecard.yml: harden-runner present in job `analysis`
- secrets-scan.yml: harden-runner present in job `trufflehog`
- secrets-scan.yml: harden-runner present in job `gitleaks`
- sscsb-scan.yml: harden-runner present in job `scan`
Info
witness out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml

Phase 4 — SAST & CI hardening

3 pass · 0 fail/gap · 0 unverified

100%

Pass
sast raw: degraded
runner-tool availability is the scanner's environment, not the repository's; all registered artifacts pre-exist
evidence
- engine: opengrep (rules: /home/runner/work/sscsb-action/sscsb-action/.sscsb/rules)
- local ruleset present (1 file(s))
- opengrep not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 1.25.0. Install: No Homebrew formula; install a pinned release binary: https://github.com/opengrep/opengrep/releases (https://github.com/opengrep/opengrep)
Info
sighthound out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Pass
codeql
evidence
- .github/workflows/codeql.yml installed (1 job(s))
Info
fuzzing out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Pass
workflow-audit-extended
evidence
- all workflows pass (SHA-pinned, least-privilege)
Info
secure-repo out of scope
informational control — excluded from scoring
evidence
- StepSecurity secure-repo is a web service (app.stepsecurity.io), not an action; run it against this repo to auto-generate hardening PRs. See docs/phase-4.md.
Info
wait-for-secrets out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml

Phase 5 — Continuous posture

3 pass · 0 fail/gap · 1 unverified

100%

Info
dependency-track out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Info
guac out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Unverified
openvex raw: info
requires the local development environment; not observable in a repository scan
evidence
- no OpenVEX documents in .sscsb/out — N/A for this repo until one is generated
- generate: `sscsb vex create --vuln CVE-… --product pkg:… --status not_affected --justification …`
- ingest: `sscsb scan --vex <file>` suppresses not_affected/fixed findings visibly
Info
oras out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Pass
security-insights
evidence
- structurally valid — run `si validate` for full schema conformance
Pass
best-practices-badge
evidence
- .sscsb/best-practices-badge.md installed (present and non-empty; no machine-checkable structure — its substance is a human judgement sscsb does not assert)
Pass
osps-baseline
evidence
- .sscsb/osps-baseline.md installed (present and non-empty; no machine-checkable structure — its substance is a human judgement sscsb does not assert)
Info
compliance-map out of scope raw: pass
informational control — excluded from scoring
evidence
- map covers all 44 controls across SLSA/SSDF/CRA/Badge

Improve this score

This record came through the authenticated lane — published by the repository's own CI via the sscsb-action. Amber and hatched links above are the work list: adopt the flagged controls, re-run the action, and the next record replaces this one.

Action docs