Security Policy violation OpenSSF Scorecard

[allstar-app]

This issue was automatically created by Allstar.

Security Policy Violation
Project is out of compliance with OpenSSF Scorecard policy.

Rule Description
This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check.
The score was 3, and the passing threshold is 10.
Results from policy: Branch-Protection : branch protection is not maximal on development and all release branches

• [0]:'allow deletion' disabled on branch 'main'
• [0]:'force pushes' disabled on branch 'main'
• [0]:'branch protection settings apply to administrators' is disabled on branch 'main'
• [0]:unable to retrieve whether 'stale review dismissal' is required to merge on branch 'main'
• [0]:could not determine whether codeowners review is allowed
• [0]:unable to retrieve whether 'last push approval' is required to merge on branch 'main'
• [0]:unable to retrieve whether 'up-to-date branches' is required to merge on branch 'main'
• [0]:no status checks found to merge onto branch 'main'
• [0]:PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings

First 10 Results from policy: CI-Tests : 0 out of 30 merged PRs checked by a CI test -- score normalized to 0

• [0]:merged PR 55 without CI test at HEAD: a871af3
• [0]:merged PR 50 without CI test at HEAD: ef64464
• [0]:merged PR 40 without CI test at HEAD: 7e4a95d
• [0]:merged PR 38 without CI test at HEAD: 2cfa38c
• [0]:merged PR 35 without CI test at HEAD: 7e471b3
• [0]:merged PR 36 without CI test at HEAD: 0c9f643
• [0]:merged PR 47 without CI test at HEAD: df79d9e
• [0]:merged PR 64 without CI test at HEAD: 933e629
• [0]:merged PR 63 without CI test at HEAD: 9e10c49
• [0]:merged PR 62 without CI test at HEAD: f931ab5
• Run a Scorecard scan to see full list.

Results from policy: CII-Best-Practices : no effort to earn an OpenSSF best practices badge detected

Results from policy: Code-Review : Found 0/4 approved changesets -- score normalized to 0

Results from policy: Fuzzing : project is not fuzzed

• no fuzzer integrations found

Results from policy: Maintained : 2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1

Results from policy: SAST : SAST tool is not run on all commits -- score normalized to 0

• [0]:0 commits out of 30 are checked with a SAST tool

---

⚠️ There is an updated version of this policy result! Click here to see the latest update

---

This issue will auto resolve when the policy is in compliance.

Issue created by Allstar. See https://github.com/ossf/allstar/ for more information. For questions specific to the repository, please contact the owner or maintainer.

[allstar-app]

The policy result has been updated.

---

Project is out of compliance with OpenSSF Scorecard policy.

Rule Description
This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check.
The score was 3, and the passing threshold is 10.
Results from policy: Branch-Protection : branch protection is not maximal on development and all release branches

• [0]:'allow deletion' disabled on branch 'main'
• [0]:'force pushes' disabled on branch 'main'
• [0]:'branch protection settings apply to administrators' is disabled on branch 'main'
• [0]:unable to retrieve whether 'stale review dismissal' is required to merge on branch 'main'
• [0]:could not determine whether codeowners review is allowed
• [0]:unable to retrieve whether 'last push approval' is required to merge on branch 'main'
• [0]:unable to retrieve whether 'up-to-date branches' is required to merge on branch 'main'
• [0]:no status checks found to merge onto branch 'main'
• [0]:PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings

First 10 Results from policy: CI-Tests : 0 out of 30 merged PRs checked by a CI test -- score normalized to 0

• [0]:merged PR 54 without CI test at HEAD: fcb11e0
• [0]:merged PR 53 without CI test at HEAD: c6a31fb
• [0]:merged PR 45 without CI test at HEAD: db6e455
• [0]:merged PR 37 without CI test at HEAD: ad17822
• [0]:merged PR 67 without CI test at HEAD: a1fae50
• [0]:merged PR 36 without CI test at HEAD: 0c9f643
• [0]:merged PR 35 without CI test at HEAD: 7e471b3
• [0]:merged PR 63 without CI test at HEAD: 9e10c49
• [0]:merged PR 56 without CI test at HEAD: 92799e0
• [0]:merged PR 55 without CI test at HEAD: a871af3
• Run a Scorecard scan to see full list.

Results from policy: CII-Best-Practices : no effort to earn an OpenSSF best practices badge detected

Results from policy: Code-Review : Found 0/4 approved changesets -- score normalized to 0

Results from policy: Fuzzing : project is not fuzzed

• no fuzzer integrations found

Results from policy: Maintained : 2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1

Results from policy: SAST : SAST tool is not run on all commits -- score normalized to 0

• [0]:0 commits out of 30 are checked with a SAST tool

[allstar-uwu-tools]

The policy result has been updated.

---

Project is out of compliance with OpenSSF Scorecard policy.

Rule Description
This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check.
The score was 3, and the passing threshold is 10.
Results from policy: Branch-Protection : branch protection is not maximal on development and all release branches

• [0]:'allow deletion' disabled on branch 'main'
• [0]:'force pushes' disabled on branch 'main'
• [0]:'branch protection settings apply to administrators' is disabled on branch 'main'
• [0]:unable to retrieve whether 'stale review dismissal' is required to merge on branch 'main'
• [0]:could not determine whether codeowners review is allowed
• [0]:unable to retrieve whether 'last push approval' is required to merge on branch 'main'
• [0]:unable to retrieve whether 'up-to-date branches' is required to merge on branch 'main'
• [0]:no status checks found to merge onto branch 'main'
• [0]:PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings

First 10 Results from policy: CI-Tests : 0 out of 30 merged PRs checked by a CI test -- score normalized to 0

• [0]:merged PR 60 without CI test at HEAD: c89c4b9
• [0]:merged PR 56 without CI test at HEAD: 92799e0
• [0]:merged PR 46 without CI test at HEAD: bc3a840
• [0]:merged PR 40 without CI test at HEAD: 7e4a95d
• [0]:merged PR 44 without CI test at HEAD: 9358a29
• [0]:merged PR 62 without CI test at HEAD: f931ab5
• [0]:merged PR 59 without CI test at HEAD: 85cbc33
• [0]:merged PR 50 without CI test at HEAD: ef64464
• [0]:merged PR 41 without CI test at HEAD: 73ead1a
• [0]:merged PR 77 without CI test at HEAD: fc8b88b
• Run a Scorecard scan to see full list.

Results from policy: CII-Best-Practices : no effort to earn an OpenSSF best practices badge detected

Results from policy: Code-Review : Found 0/6 approved changesets -- score normalized to 0

Results from policy: Fuzzing : project is not fuzzed

• no fuzzer integrations found

Results from policy: Maintained : 4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3

Results from policy: SAST : SAST tool is not run on all commits -- score normalized to 0

• [0]:0 commits out of 30 are checked with a SAST tool

[allstar-uwu-tools]

The policy result has been updated.

---

Project is out of compliance with OpenSSF Scorecard policy.

Rule Description
This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check.
The score was 3, and the passing threshold is 10.
Results from policy: Branch-Protection : branch protection is not maximal on development and all release branches

• [0]:'allow deletion' disabled on branch 'main'
• [0]:'force pushes' disabled on branch 'main'
• [0]:'branch protection settings apply to administrators' is disabled on branch 'main'
• [0]:unable to retrieve whether 'stale review dismissal' is required to merge on branch 'main'
• [0]:could not determine whether codeowners review is allowed
• [0]:unable to retrieve whether 'last push approval' is required to merge on branch 'main'
• [0]:unable to retrieve whether 'up-to-date branches' is required to merge on branch 'main'
• [0]:no status checks found to merge onto branch 'main'
• [0]:PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings

First 10 Results from policy: CI-Tests : 0 out of 30 merged PRs checked by a CI test -- score normalized to 0

• [0]:merged PR 51 without CI test at HEAD: 0310f9d
• [0]:merged PR 48 without CI test at HEAD: 810454b
• [0]:merged PR 39 without CI test at HEAD: 6383bc3
• [0]:merged PR 56 without CI test at HEAD: 92799e0
• [0]:merged PR 71 without CI test at HEAD: 89a3043
• [0]:merged PR 64 without CI test at HEAD: 933e629
• [0]:merged PR 61 without CI test at HEAD: 1ce1d1c
• [0]:merged PR 53 without CI test at HEAD: c6a31fb
• [0]:merged PR 50 without CI test at HEAD: ef64464
• [0]:merged PR 44 without CI test at HEAD: 9358a29
• Run a Scorecard scan to see full list.

Results from policy: CII-Best-Practices : no effort to earn an OpenSSF best practices badge detected

Results from policy: Code-Review : Found 0/6 approved changesets -- score normalized to 0

Results from policy: Fuzzing : project is not fuzzed

• no fuzzer integrations found

Results from policy: Maintained : 4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3

Results from policy: SAST : SAST tool is not run on all commits -- score normalized to 0

• [0]:0 commits out of 30 are checked with a SAST tool

[allstar-uwu-tools]

The policy result has been updated.

---

Project is out of compliance with OpenSSF Scorecard policy.

Rule Description
This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check.
The score was 3, and the passing threshold is 10.
Results from policy: Branch-Protection : branch protection is not maximal on development and all release branches

• [0]:'allow deletion' disabled on branch 'main'
• [0]:'force pushes' disabled on branch 'main'
• [0]:'branch protection settings apply to administrators' is disabled on branch 'main'
• [0]:unable to retrieve whether 'stale review dismissal' is required to merge on branch 'main'
• [0]:could not determine whether codeowners review is allowed
• [0]:unable to retrieve whether 'last push approval' is required to merge on branch 'main'
• [0]:unable to retrieve whether 'up-to-date branches' is required to merge on branch 'main'
• [0]:no status checks found to merge onto branch 'main'
• [0]:PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings

First 10 Results from policy: CI-Tests : 0 out of 30 merged PRs checked by a CI test -- score normalized to 0

• [0]:merged PR 59 without CI test at HEAD: 85cbc33
• [0]:merged PR 67 without CI test at HEAD: a1fae50
• [0]:merged PR 52 without CI test at HEAD: 7728eda
• [0]:merged PR 39 without CI test at HEAD: 6383bc3
• [0]:merged PR 37 without CI test at HEAD: ad17822
• [0]:merged PR 60 without CI test at HEAD: c89c4b9
• [0]:merged PR 57 without CI test at HEAD: 1f9e99b
• [0]:merged PR 41 without CI test at HEAD: 73ead1a
• [0]:merged PR 62 without CI test at HEAD: f931ab5
• [0]:merged PR 61 without CI test at HEAD: 1ce1d1c
• Run a Scorecard scan to see full list.

Results from policy: CII-Best-Practices : no effort to earn an OpenSSF best practices badge detected

Results from policy: Code-Review : Found 0/6 approved changesets -- score normalized to 0

Results from policy: Fuzzing : project is not fuzzed

• no fuzzer integrations found

Results from policy: Maintained : 4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3

Results from policy: SAST : SAST tool is not run on all commits -- score normalized to 0

• [0]:0 commits out of 30 are checked with a SAST tool

[allstar-uwu-tools]

The policy result has been updated.

---

Project is out of compliance with OpenSSF Scorecard policy.

Rule Description
This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check.
The score was 3, and the passing threshold is 10.
Results from policy: Branch-Protection : branch protection is not maximal on development and all release branches

• [0]:'allow deletion' disabled on branch 'main'
• [0]:'force pushes' disabled on branch 'main'
• [0]:'branch protection settings apply to administrators' is disabled on branch 'main'
• [0]:unable to retrieve whether 'stale review dismissal' is required to merge on branch 'main'
• [0]:could not determine whether codeowners review is allowed
• [0]:unable to retrieve whether 'last push approval' is required to merge on branch 'main'
• [0]:unable to retrieve whether 'up-to-date branches' is required to merge on branch 'main'
• [0]:no status checks found to merge onto branch 'main'
• [0]:PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings

First 10 Results from policy: CI-Tests : 0 out of 30 merged PRs checked by a CI test -- score normalized to 0

• [0]:merged PR 73 without CI test at HEAD: 2371ba6
• [0]:merged PR 63 without CI test at HEAD: 9e10c49
• [0]:merged PR 60 without CI test at HEAD: c89c4b9
• [0]:merged PR 44 without CI test at HEAD: 9358a29
• [0]:merged PR 40 without CI test at HEAD: 7e4a95d
• [0]:merged PR 77 without CI test at HEAD: fc8b88b
• [0]:merged PR 67 without CI test at HEAD: a1fae50
• [0]:merged PR 64 without CI test at HEAD: 933e629
• [0]:merged PR 62 without CI test at HEAD: f931ab5
• [0]:merged PR 59 without CI test at HEAD: 85cbc33
• Run a Scorecard scan to see full list.

Results from policy: CII-Best-Practices : no effort to earn an OpenSSF best practices badge detected

Results from policy: Code-Review : Found 0/6 approved changesets -- score normalized to 0

Results from policy: Fuzzing : project is not fuzzed

• no fuzzer integrations found

Results from policy: Maintained : 4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3

Results from policy: SAST : SAST tool is not run on all commits -- score normalized to 0

• [0]:0 commits out of 30 are checked with a SAST tool

[allstar-uwu-tools]

The policy result has been updated.

---

Project is out of compliance with OpenSSF Scorecard policy.

Rule Description
This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check.
The score was 3, and the passing threshold is 10.
Results from policy: Branch-Protection : branch protection is not maximal on development and all release branches

• [0]:'allow deletion' disabled on branch 'main'
• [0]:'force pushes' disabled on branch 'main'
• [0]:'branch protection settings apply to administrators' is disabled on branch 'main'
• [0]:unable to retrieve whether 'stale review dismissal' is required to merge on branch 'main'
• [0]:could not determine whether codeowners review is allowed
• [0]:unable to retrieve whether 'last push approval' is required to merge on branch 'main'
• [0]:unable to retrieve whether 'up-to-date branches' is required to merge on branch 'main'
• [0]:no status checks found to merge onto branch 'main'
• [0]:PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings

First 10 Results from policy: CI-Tests : 0 out of 30 merged PRs checked by a CI test -- score normalized to 0

• [0]:merged PR 67 without CI test at HEAD: a1fae50
• [0]:merged PR 53 without CI test at HEAD: c6a31fb
• [0]:merged PR 73 without CI test at HEAD: 2371ba6
• [0]:merged PR 60 without CI test at HEAD: c89c4b9
• [0]:merged PR 52 without CI test at HEAD: 7728eda
• [0]:merged PR 77 without CI test at HEAD: fc8b88b
• [0]:merged PR 63 without CI test at HEAD: 9e10c49
• [0]:merged PR 57 without CI test at HEAD: 1f9e99b
• [0]:merged PR 45 without CI test at HEAD: db6e455
• [0]:merged PR 40 without CI test at HEAD: 7e4a95d
• Run a Scorecard scan to see full list.

Results from policy: CII-Best-Practices : no effort to earn an OpenSSF best practices badge detected

Results from policy: Code-Review : Found 0/6 approved changesets -- score normalized to 0

Results from policy: Fuzzing : project is not fuzzed

• no fuzzer integrations found

Results from policy: Maintained : 4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3

Results from policy: SAST : SAST tool is not run on all commits -- score normalized to 0

• [0]:0 commits out of 30 are checked with a SAST tool

[allstar-uwu-tools]

The policy result has been updated.

---

Project is out of compliance with OpenSSF Scorecard policy.

Rule Description
This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check.
The score was 3, and the passing threshold is 10.
Results from policy: Branch-Protection : branch protection is not maximal on development and all release branches

• [0]:'allow deletion' disabled on branch 'main'
• [0]:'force pushes' disabled on branch 'main'
• [0]:'branch protection settings apply to administrators' is disabled on branch 'main'
• [0]:unable to retrieve whether 'stale review dismissal' is required to merge on branch 'main'
• [0]:could not determine whether codeowners review is allowed
• [0]:unable to retrieve whether 'last push approval' is required to merge on branch 'main'
• [0]:unable to retrieve whether 'up-to-date branches' is required to merge on branch 'main'
• [0]:no status checks found to merge onto branch 'main'
• [0]:PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings

First 10 Results from policy: CI-Tests : 0 out of 30 merged PRs checked by a CI test -- score normalized to 0

• [0]:merged PR 57 without CI test at HEAD: 1f9e99b
• [0]:merged PR 77 without CI test at HEAD: fc8b88b
• [0]:merged PR 67 without CI test at HEAD: a1fae50
• [0]:merged PR 53 without CI test at HEAD: c6a31fb
• [0]:merged PR 48 without CI test at HEAD: 810454b
• [0]:merged PR 47 without CI test at HEAD: df79d9e
• [0]:merged PR 41 without CI test at HEAD: 73ead1a
• [0]:merged PR 73 without CI test at HEAD: 2371ba6
• [0]:merged PR 55 without CI test at HEAD: a871af3
• [0]:merged PR 71 without CI test at HEAD: 89a3043
• Run a Scorecard scan to see full list.

Results from policy: CII-Best-Practices : no effort to earn an OpenSSF best practices badge detected

Results from policy: Code-Review : Found 0/6 approved changesets -- score normalized to 0

Results from policy: Fuzzing : project is not fuzzed

• no fuzzer integrations found

Results from policy: Maintained : 4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3

Results from policy: SAST : SAST tool is not run on all commits -- score normalized to 0

• [0]:0 commits out of 30 are checked with a SAST tool

[allstar-uwu-tools]

The policy result has been updated.

---

Project is out of compliance with OpenSSF Scorecard policy.

Rule Description
This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check.
The score was 3, and the passing threshold is 10.
Results from policy: Branch-Protection : branch protection is not maximal on development and all release branches

• [0]:'allow deletion' disabled on branch 'main'
• [0]:'force pushes' disabled on branch 'main'
• [0]:'branch protection settings apply to administrators' is disabled on branch 'main'
• [0]:unable to retrieve whether 'stale review dismissal' is required to merge on branch 'main'
• [0]:could not determine whether codeowners review is allowed
• [0]:unable to retrieve whether 'last push approval' is required to merge on branch 'main'
• [0]:unable to retrieve whether 'up-to-date branches' is required to merge on branch 'main'
• [0]:no status checks found to merge onto branch 'main'
• [0]:PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings

First 10 Results from policy: CI-Tests : 0 out of 30 merged PRs checked by a CI test -- score normalized to 0

• [0]:merged PR 38 without CI test at HEAD: 2cfa38c
• [0]:merged PR 71 without CI test at HEAD: 89a3043
• [0]:merged PR 67 without CI test at HEAD: a1fae50
• [0]:merged PR 58 without CI test at HEAD: e3b251c
• [0]:merged PR 53 without CI test at HEAD: c6a31fb
• [0]:merged PR 44 without CI test at HEAD: 9358a29
• [0]:merged PR 40 without CI test at HEAD: 7e4a95d
• [0]:merged PR 78 without CI test at HEAD: f49a899
• [0]:merged PR 64 without CI test at HEAD: 933e629
• [0]:merged PR 57 without CI test at HEAD: 1f9e99b
• Run a Scorecard scan to see full list.

Results from policy: CII-Best-Practices : no effort to earn an OpenSSF best practices badge detected

Results from policy: Code-Review : Found 0/7 approved changesets -- score normalized to 0

Results from policy: Fuzzing : project is not fuzzed

• no fuzzer integrations found

Results from policy: Maintained : 5 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4

Results from policy: Pinned-Dependencies : dependency not pinned by hash detected -- score normalized to 9

• .github/workflows/allstar.yml[77]:third-party GitHubAction not pinned by hash
• [0]: 8 out of 8 GitHub-owned GitHubAction dependencies pinned
• [0]: 7 out of 8 third-party GitHubAction dependencies pinned

Results from policy: SAST : SAST tool is not run on all commits -- score normalized to 0

• [0]:0 commits out of 30 are checked with a SAST tool

[allstar-uwu-tools]

The policy result has been updated.

---

Project is out of compliance with OpenSSF Scorecard policy.

Rule Description
This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check.
The score was 3, and the passing threshold is 10.
Results from policy: Branch-Protection : branch protection is not maximal on development and all release branches

• [0]:'allow deletion' disabled on branch 'main'
• [0]:'force pushes' disabled on branch 'main'
• [0]:'branch protection settings apply to administrators' is disabled on branch 'main'
• [0]:unable to retrieve whether 'stale review dismissal' is required to merge on branch 'main'
• [0]:could not determine whether codeowners review is allowed
• [0]:unable to retrieve whether 'last push approval' is required to merge on branch 'main'
• [0]:unable to retrieve whether 'up-to-date branches' is required to merge on branch 'main'
• [0]:no status checks found to merge onto branch 'main'
• [0]:PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings

First 10 Results from policy: CI-Tests : 0 out of 30 merged PRs checked by a CI test -- score normalized to 0

• [0]:merged PR 59 without CI test at HEAD: 85cbc33
• [0]:merged PR 57 without CI test at HEAD: 1f9e99b
• [0]:merged PR 53 without CI test at HEAD: c6a31fb
• [0]:merged PR 51 without CI test at HEAD: 0310f9d
• [0]:merged PR 77 without CI test at HEAD: fc8b88b
• [0]:merged PR 71 without CI test at HEAD: 89a3043
• [0]:merged PR 48 without CI test at HEAD: 810454b
• [0]:merged PR 47 without CI test at HEAD: df79d9e
• [0]:merged PR 40 without CI test at HEAD: 7e4a95d
• [0]:merged PR 75 without CI test at HEAD: 766db33
• Run a Scorecard scan to see full list.

Results from policy: CII-Best-Practices : no effort to earn an OpenSSF best practices badge detected

Results from policy: Code-Review : Found 0/7 approved changesets -- score normalized to 0

Results from policy: Fuzzing : project is not fuzzed

• no fuzzer integrations found

Results from policy: Maintained : 5 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4

Results from policy: Pinned-Dependencies : dependency not pinned by hash detected -- score normalized to 9

• .github/workflows/allstar.yml[77]:third-party GitHubAction not pinned by hash
• [0]: 8 out of 8 GitHub-owned GitHubAction dependencies pinned
• [0]: 7 out of 8 third-party GitHubAction dependencies pinned

Results from policy: SAST : SAST tool is not run on all commits -- score normalized to 0

• [0]:0 commits out of 30 are checked with a SAST tool

[allstar-uwu-tools]

The policy result has been updated.

---

Project is out of compliance with OpenSSF Scorecard policy.

Rule Description
This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check.
The score was 3, and the passing threshold is 10.
Results from policy: Branch-Protection : branch protection is not maximal on development and all release branches

• [0]:'allow deletion' disabled on branch 'main'
• [0]:'force pushes' disabled on branch 'main'
• [0]:'branch protection settings apply to administrators' is disabled on branch 'main'
• [0]:unable to retrieve whether 'stale review dismissal' is required to merge on branch 'main'
• [0]:could not determine whether codeowners review is allowed
• [0]:unable to retrieve whether 'last push approval' is required to merge on branch 'main'
• [0]:unable to retrieve whether 'up-to-date branches' is required to merge on branch 'main'
• [0]:no status checks found to merge onto branch 'main'
• [0]:PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings

First 10 Results from policy: CI-Tests : 0 out of 30 merged PRs checked by a CI test -- score normalized to 0

• [0]:merged PR 40 without CI test at HEAD: 7e4a95d
• [0]:merged PR 55 without CI test at HEAD: a871af3
• [0]:merged PR 45 without CI test at HEAD: db6e455
• [0]:merged PR 67 without CI test at HEAD: a1fae50
• [0]:merged PR 61 without CI test at HEAD: 1ce1d1c
• [0]:merged PR 46 without CI test at HEAD: bc3a840
• [0]:merged PR 38 without CI test at HEAD: 2cfa38c
• [0]:merged PR 75 without CI test at HEAD: 766db33
• [0]:merged PR 62 without CI test at HEAD: f931ab5
• [0]:merged PR 60 without CI test at HEAD: c89c4b9
• Run a Scorecard scan to see full list.

Results from policy: CII-Best-Practices : no effort to earn an OpenSSF best practices badge detected

Results from policy: Code-Review : Found 0/7 approved changesets -- score normalized to 0

Results from policy: Fuzzing : project is not fuzzed

• no fuzzer integrations found

Results from policy: Maintained : 5 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4

Results from policy: Pinned-Dependencies : dependency not pinned by hash detected -- score normalized to 9

• .github/workflows/allstar.yml[77]:third-party GitHubAction not pinned by hash
• [0]: 8 out of 8 GitHub-owned GitHubAction dependencies pinned
• [0]: 7 out of 8 third-party GitHubAction dependencies pinned

Results from policy: SAST : SAST tool is not run on all commits -- score normalized to 0

• [0]:0 commits out of 30 are checked with a SAST tool

[allstar-uwu-tools]

The policy result has been updated.

---

Project is out of compliance with OpenSSF Scorecard policy.

Rule Description
This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check.
The score was 5, and the passing threshold is 10.
Results from policy: Maintained : 6 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5

Results from policy: Security-Policy : security policy file detected

• security policy file detected
• Found linked content
• One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy
• Found text in security policy

Results from policy: Code-Review : Found 0/8 approved changesets -- score normalized to 0

Results from policy: Pinned-Dependencies : dependency not pinned by hash detected -- score normalized to 9

• .github/workflows/allstar.yml[77]:third-party GitHubAction not pinned by hash
• [0]: 8 out of 8 GitHub-owned GitHubAction dependencies pinned
• [0]: 7 out of 8 third-party GitHubAction dependencies pinned

Results from policy: CII-Best-Practices : no effort to earn an OpenSSF best practices badge detected

Results from policy: Fuzzing : project is not fuzzed

• no fuzzer integrations found

Results from policy: Branch-Protection : branch protection is not maximal on development and all release branches

• [0]:'allow deletion' disabled on branch 'main'
• [0]:'force pushes' disabled on branch 'main'
• [0]:'branch protection settings apply to administrators' is disabled on branch 'main'
• [0]:unable to retrieve whether 'stale review dismissal' is required to merge on branch 'main'
• [0]:could not determine whether codeowners review is allowed
• [0]:unable to retrieve whether 'last push approval' is required to merge on branch 'main'
• [0]:unable to retrieve whether 'up-to-date branches' is required to merge on branch 'main'
• [0]:no status checks found to merge onto branch 'main'
• [0]:PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings

Results from policy: SAST : SAST tool is not run on all commits -- score normalized to 0

• [0]:0 commits out of 30 are checked with a SAST tool

First 10 Results from policy: CI-Tests : 0 out of 30 merged PRs checked by a CI test -- score normalized to 0

• [0]:merged PR 75 without CI test at HEAD: 766db33
• [0]:merged PR 51 without CI test at HEAD: 0310f9d
• [0]:merged PR 48 without CI test at HEAD: 810454b
• [0]:merged PR 39 without CI test at HEAD: 6383bc3
• [0]:merged PR 77 without CI test at HEAD: fc8b88b
• [0]:merged PR 63 without CI test at HEAD: 9e10c49
• [0]:merged PR 56 without CI test at HEAD: 92799e0
• [0]:merged PR 47 without CI test at HEAD: df79d9e
• [0]:merged PR 58 without CI test at HEAD: e3b251c
• [0]:merged PR 55 without CI test at HEAD: a871af3
• Run a Scorecard scan to see full list.

[allstar-uwu-tools]

The policy result has been updated.

---

Project is out of compliance with OpenSSF Scorecard policy.

Rule Description
This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check.
The score was 5, and the passing threshold is 10.
Results from policy: Maintained : 6 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5

Results from policy: Code-Review : Found 0/8 approved changesets -- score normalized to 0

Results from policy: Pinned-Dependencies : dependency not pinned by hash detected -- score normalized to 9

• .github/workflows/allstar.yml[77]:third-party GitHubAction not pinned by hash
• [0]: 8 out of 8 GitHub-owned GitHubAction dependencies pinned
• [0]: 7 out of 8 third-party GitHubAction dependencies pinned

Results from policy: Security-Policy : security policy file detected

• security policy file detected
• Found linked content
• One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy
• Found text in security policy

Results from policy: CII-Best-Practices : no effort to earn an OpenSSF best practices badge detected

Results from policy: Fuzzing : project is not fuzzed

• no fuzzer integrations found

Results from policy: Branch-Protection : branch protection is not maximal on development and all release branches

• [0]:'allow deletion' disabled on branch 'main'
• [0]:'force pushes' disabled on branch 'main'
• [0]:'branch protection settings apply to administrators' is disabled on branch 'main'
• [0]:unable to retrieve whether 'stale review dismissal' is required to merge on branch 'main'
• [0]:could not determine whether codeowners review is allowed
• [0]:unable to retrieve whether 'last push approval' is required to merge on branch 'main'
• [0]:unable to retrieve whether 'up-to-date branches' is required to merge on branch 'main'
• [0]:no status checks found to merge onto branch 'main'
• [0]:PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings

Results from policy: SAST : SAST tool is not run on all commits -- score normalized to 0

• [0]:0 commits out of 30 are checked with a SAST tool

First 10 Results from policy: CI-Tests : 0 out of 30 merged PRs checked by a CI test -- score normalized to 0

• [0]:merged PR 55 without CI test at HEAD: a871af3
• [0]:merged PR 52 without CI test at HEAD: 7728eda
• [0]:merged PR 64 without CI test at HEAD: 933e629
• [0]:merged PR 59 without CI test at HEAD: 85cbc33
• [0]:merged PR 67 without CI test at HEAD: a1fae50
• [0]:merged PR 61 without CI test at HEAD: 1ce1d1c
• [0]:merged PR 57 without CI test at HEAD: 1f9e99b
• [0]:merged PR 48 without CI test at HEAD: 810454b
• [0]:merged PR 50 without CI test at HEAD: ef64464
• [0]:merged PR 54 without CI test at HEAD: fcb11e0
• Run a Scorecard scan to see full list.

[allstar-uwu-tools]

The policy result has been updated.

---

Project is out of compliance with OpenSSF Scorecard policy.

Rule Description
This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check.
The score was 0, and the passing threshold is 10.
Results from policy: Code-Review : Found 0/8 approved changesets -- score normalized to 0

Results from policy: Security-Policy : security policy file detected

• security policy file detected
• Found linked content
• One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy
• Found text in security policy

Results from policy: Maintained : 6 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5

Results from policy: Pinned-Dependencies : dependency not pinned by hash detected -- score normalized to 9

• .github/workflows/allstar.yml[77]:third-party GitHubAction not pinned by hash
• [0]: 8 out of 8 GitHub-owned GitHubAction dependencies pinned
• [0]: 7 out of 8 third-party GitHubAction dependencies pinned

Results from policy: Fuzzing : project is not fuzzed

• no fuzzer integrations found

Results from policy: Branch-Protection : branch protection is not maximal on development and all release branches

• [0]:'allow deletion' disabled on branch 'main'
• [0]:'force pushes' disabled on branch 'main'
• [0]:'branch protection settings apply to administrators' is disabled on branch 'main'
• [0]:unable to retrieve whether 'stale review dismissal' is required to merge on branch 'main'
• [0]:could not determine whether codeowners review is allowed
• [0]:unable to retrieve whether 'last push approval' is required to merge on branch 'main'
• [0]:unable to retrieve whether 'up-to-date branches' is required to merge on branch 'main'
• [0]:no status checks found to merge onto branch 'main'
• [0]:PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings

Results from policy: CII-Best-Practices : no effort to earn an OpenSSF best practices badge detected

Results from policy: SAST : SAST tool is not run on all commits -- score normalized to 0

• [0]:0 commits out of 30 are checked with a SAST tool

First 10 Results from policy: CI-Tests : 0 out of 30 merged PRs checked by a CI test -- score normalized to 0

• [0]:merged PR 75 without CI test at HEAD: 766db33
• [0]:merged PR 67 without CI test at HEAD: a1fae50
• [0]:merged PR 63 without CI test at HEAD: 9e10c49
• [0]:merged PR 57 without CI test at HEAD: 1f9e99b
• [0]:merged PR 47 without CI test at HEAD: df79d9e
• [0]:merged PR 41 without CI test at HEAD: 73ead1a
• [0]:merged PR 58 without CI test at HEAD: e3b251c
• [0]:merged PR 56 without CI test at HEAD: 92799e0
• [0]:merged PR 54 without CI test at HEAD: fcb11e0
• [0]:merged PR 50 without CI test at HEAD: ef64464
• Run a Scorecard scan to see full list.

[allstar-uwu-tools]

The policy result has been updated.

---

Project is out of compliance with OpenSSF Scorecard policy.

Rule Description
This is a generic passthrough policy that runs the configured checks from OpenSSF Scorecard. Please see the OpenSSF Scorecard documentation for more information on each check.
The score was 0, and the passing threshold is 10.
Results from policy: Code-Review : Found 0/8 approved changesets -- score normalized to 0

Results from policy: Security-Policy : security policy file detected

• security policy file detected
• Found linked content
• One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy
• Found text in security policy

Results from policy: Maintained : 6 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5

Results from policy: Pinned-Dependencies : dependency not pinned by hash detected -- score normalized to 9

• .github/workflows/allstar.yml[77]:third-party GitHubAction not pinned by hash
• [0]: 8 out of 8 GitHub-owned GitHubAction dependencies pinned
• [0]: 7 out of 8 third-party GitHubAction dependencies pinned

Results from policy: CII-Best-Practices : no effort to earn an OpenSSF best practices badge detected

Results from policy: Fuzzing : project is not fuzzed

• no fuzzer integrations found

Results from policy: Branch-Protection : branch protection is not maximal on development and all release branches

• [0]:'allow deletion' disabled on branch 'main'
• [0]:'force pushes' disabled on branch 'main'
• [0]:'branch protection settings apply to administrators' is disabled on branch 'main'
• [0]:unable to retrieve whether 'stale review dismissal' is required to merge on branch 'main'
• [0]:could not determine whether codeowners review is allowed
• [0]:unable to retrieve whether 'last push approval' is required to merge on branch 'main'
• [0]:unable to retrieve whether 'up-to-date branches' is required to merge on branch 'main'
• [0]:no status checks found to merge onto branch 'main'
• [0]:PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings

Results from policy: SAST : SAST tool is not run on all commits -- score normalized to 0

• [0]:0 commits out of 30 are checked with a SAST tool

First 10 Results from policy: CI-Tests : 0 out of 30 merged PRs checked by a CI test -- score normalized to 0

• [0]:merged PR 53 without CI test at HEAD: c6a31fb
• [0]:merged PR 52 without CI test at HEAD: 7728eda
• [0]:merged PR 75 without CI test at HEAD: 766db33
• [0]:merged PR 57 without CI test at HEAD: 1f9e99b
• [0]:merged PR 55 without CI test at HEAD: a871af3
• [0]:merged PR 46 without CI test at HEAD: bc3a840
• [0]:merged PR 62 without CI test at HEAD: f931ab5
• [0]:merged PR 60 without CI test at HEAD: c89c4b9
• [0]:merged PR 45 without CI test at HEAD: db6e455
• [0]:merged PR 44 without CI test at HEAD: 9358a29
• Run a Scorecard scan to see full list.