scorecard

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

OpenSSF Scorecard Audit — py-lintro

OpenSSF Scorecard审计 — py-lintro

Audit the OpenSSF Scorecard rating for

github.com/lgtm-hq/py-lintro

and identify what's dragging the score down.

针对

github.com/lgtm-hq/py-lintro

项目开展OpenSSF Scorecard评分审计，找出拖低评分的原因。

Step 1: Fetch Current Score

步骤1：获取当前评分

Run the following to get the latest scorecard results:

bash

undefined

运行以下命令获取最新的评分卡结果：

bash

undefined

Get the latest scorecard JSON from the API

curl -s "https://api.securityscorecards.dev/projects/github.com/lgtm-hq/py-lintro" | python3 -m json.tool


Also check the
[scorecard viewer](https://scorecard.dev/viewer/?uri=github.com/lgtm-hq/py-lintro).

curl -s "https://api.securityscorecards.dev/projects/github.com/lgtm-hq/py-lintro" | python3 -m json.tool


同时查看[评分卡查看器](https://scorecard.dev/viewer/?uri=github.com/lgtm-hq/py-lintro)。

Step 2: Evaluate Each Check

步骤2：评估各项检查

Compare the live results against the baseline findings below. For each check, determine whether the score has improved, regressed, or stayed the same.

将实时结果与下方的基线发现进行对比。针对每项检查，判断评分是提升、下降还是保持不变。

Baseline Findings (2026-02-20, score 5.8/10)

基线发现（2026-02-20，评分5.8/10）

Check	Score	Root Cause
Code-Review	0/10	Single maintainer — PRs by `TurboCoder13` have no distinct human reviewer. CodeRabbit (AI bot) reviews don't count.
Token-Permissions	0/10	Workflows escalate to `write` permissions at the job level ( `packages: write` , `pull-requests: write` , `contents: write` ). Scorecard wants minimal top-level permissions on every workflow file.
Signed-Releases	0/10	PyPI attestations and Docker provenance exist but scorecard expects Sigstore signatures or `actions/attest-build-provenance` on GitHub Release artifacts themselves.
Pinned-Dependencies	-1 (error)	`FROM ${TOOLS_IMAGE}` ARG indirection in Dockerfile causes a scorecard parsing error. The image IS pinned by digest — this is a known scorecard limitation. Do not "fix" this — the parameterization is load-bearing (used by CI, docker-compose, Makefile, scripts for PR testing with swappable tools images). Also: `apt-get install` on line 48 lacks version pins.
Fuzzing	0/10	No OSS-Fuzz or ClusterFuzzLite integration.
CI-Tests	5/10	Tests detected on only ~57% of merged PRs. Bot/release PRs (from `github-actions[bot]` ) skip full test flow, skewing the metric.
Security-Policy	4/10	SECURITY.md uses a personal email instead of GitHub's private vulnerability reporting.
Contributors	3/10	Single human contributor. Inherent to the project — cannot easily change.
CII-Best-Practices	2/10	OpenSSF Best Practices badge was "InProgress". User reported 99% complete as of 2026-02-20 — scorecard may lag.
Vulnerabilities	7/10	Open Dependabot alerts (11 at baseline).
SAST	8/10	CodeQL configured but may not cover all commit paths.
Branch-Protection	6/10	Allstar configured but `requireStatusChecks` is empty and `requireCodeOwnerReviews` is false.
Dependency-Update-Tool	10/10	Renovate configured and active.
Maintained	10/10	Active development.
Dangerous-Workflow	10/10	No dangerous patterns.
Binary-Artifacts	10/10	Clean.
Packaging	10/10	OIDC trusted publishing to PyPI.
License	10/10	MIT.

检查项	评分	根本原因
Code-Review	0/10	单一维护者——TurboCoder13提交的PR没有独立的人工审核者。CodeRabbit（AI机器人）的审核不计入在内。
Token-Permissions	0/10	工作流在任务级别提升至 `write` 权限（ `packages: write` 、 `pull-requests: write` 、 `contents: write` ）。评分卡要求每个工作流文件使用最小化的顶级权限。
Signed-Releases	0/10	存在PyPI证明和Docker溯源，但评分卡要求GitHub Release工件本身带有Sigstore签名或使用 `actions/attest-build-provenance` 。
Pinned-Dependencies	-1（错误）	Dockerfile中的 `FROM ${TOOLS_IMAGE}` 参数间接引用导致评分卡解析错误。实际上镜像已通过摘要固定——这是评分卡的已知限制。请勿“修复”此问题——该参数化是必要的（CI、docker-compose、Makefile、PR测试脚本均使用它来切换工具镜像）。此外：第48行的 `apt-get install` 未固定版本。
Fuzzing	0/10	未集成OSS-Fuzz或ClusterFuzzLite。
CI-Tests	5/10	仅约57%的合并PR执行了测试。机器人/发布PR（来自 `github-actions[bot]` ）跳过完整测试流程，导致指标失真。
Security-Policy	4/10	SECURITY.md使用个人邮箱而非GitHub的私有漏洞报告渠道。
Contributors	3/10	仅一位人类贡献者。这是项目固有属性，难以轻易改变。
CII-Best-Practices	2/10	OpenSSF最佳实践徽章处于“InProgress”状态。截至2026-02-20，用户报告已完成99%——评分卡可能存在延迟。
Vulnerabilities	7/10	存在未处理的Dependabot警报（基线时有11个）。
SAST	8/10	已配置CodeQL，但可能未覆盖所有提交路径。
Branch-Protection	6/10	已配置Allstar，但 `requireStatusChecks` 为空， `requireCodeOwnerReviews` 为false。
Dependency-Update-Tool	10/10	已配置并启用Renovate。
Maintained	10/10	开发活动活跃。
Dangerous-Workflow	10/10	未发现危险模式。
Binary-Artifacts	10/10	无问题。
Packaging	10/10	已通过OIDC可信发布至PyPI。
License	10/10	MIT许可证。

Known Non-Issues (Do Not Recommend Fixing)

已知非问题（不建议修复）

Pinned-Dependencies / Dockerfile ARG: The
```
FROM ${TOOLS_IMAGE}
```
pattern is intentional and used across CI pipelines, docker-compose, Makefile, and scripts for build-time image swapping. The image is pinned by digest. Scorecard cannot parse ARG indirection — this is their bug, not ours.
Contributors: Single-maintainer project. Score will naturally improve if more contributors join.
Code-Review: Inherently limited by single-maintainer status. Would need a second trusted reviewer.

Pinned-Dependencies / Dockerfile ARG：
```
FROM ${TOOLS_IMAGE}
```
模式是有意设计的，CI流水线、docker-compose、Makefile和脚本均使用它在构建时切换镜像。镜像已通过摘要固定。评分卡无法解析参数间接引用——这是评分卡的问题，而非我们的问题。
Contributors：单一维护者项目。若有更多贡献者加入，评分自然会提升。
Code-Review：受限于单一维护者的固有状态。需要第二位可信审核者才能改善。

GitHub Repo Settings to Check

需要检查的GitHub仓库设置

bash

undefined

bash

undefined

Check security settings

gh api repos/lgtm-hq/py-lintro --jq '.security_and_analysis'


At baseline, these were **disabled** (not scored by scorecard but still worth tracking):

- `secret_scanning`
- `secret_scanning_push_protection`
- `dependabot_security_updates`

gh api repos/lgtm-hq/py-lintro --jq '.security_and_analysis'


基线时，以下功能处于**禁用**状态（评分卡未纳入评分，但仍值得跟踪）：

- `secret_scanning`
- `secret_scanning_push_protection`
- `dependabot_security_updates`

Step 3: Report

步骤3：生成报告

Present findings in this format:

markdown

undefined

按以下格式呈现发现结果：

markdown

undefined

OpenSSF Scorecard Audit — py-lintro

Current Score: X.X/10 Previous Score: 5.8/10 (2026-02-20) Trend: Improved / Regressed / Unchanged

Check-by-Check Comparison

Check	Baseline	Current	Delta	Notes
...	...	...	...	...

Check	Baseline	Current	Delta	Notes
...	...	...	...	...

What's Still Missing

[check] — [why it's still low and what would fix it]

[check] — [why it's still low and what would fix it]

What Improved

[check] — [what changed]

[check] — [what changed]

Recommended Next Actions (prioritized by score impact)

[action]

undefined

[action]

undefined

Step 4: Update This Skill

步骤4：更新此Skill

If the audit reveals new findings, outdated information, or checks that have been resolved, update the baseline table in this skill file:

text

Edit skills/scorecard/SKILL.md

Update the following sections:

Baseline Findings table — update scores, root causes, and the date
Known Non-Issues — add or remove entries as appropriate
GitHub Repo Settings — update if settings have changed

This keeps the skill accurate for future invocations.

若审计发现新结果、过时信息或已解决的检查项，请更新此Skill文件中的基线表格：

text

Edit skills/scorecard/SKILL.md

更新以下部分：

基线发现表格——更新评分、根本原因和日期
已知非问题——根据需要添加或移除条目
GitHub仓库设置——若设置有变更则更新

这将确保该Skill在后续调用时保持准确。