A+

p4gs/sscsb-action

CI · verified+local 6

https://github.com/p4gs/sscsb-action scanned 2026-09-03 at c7deeef08747 on main sscsb 0.3.1 methodology v1 scan runscored before v2

100%

of the answered checks passed

87.1%

of the checks were answered at all

clears the 75% floorThe grade is not provisional. How coverage is scored →

Commit integrity 100%

Dependencies 100%

Build receipts 100%

Code & build hardening 100%

Ongoing posture 100%

Distribution & publishing n/a no checks in scope

Defences found, by attack group

This lists defences the scan found, not weaknesses it found. A missing defence is not a break-in, and a full set of checks is not safety: nine groups and 54 checks do not cover everything. What the nine groups are →

A1 Poisoned commit All answered checks passed Every answered check passed — 5 of 5. 2 more produced no answer. No answer signing-model, scorecard — 1 of these only a maintainer's own machine can answer Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
A2 Stolen publisher identity All answered checks passed Every answered check passed — 6 of 6. 1 more produced no answer. No answer signing-model — all of these only a maintainer's own machine can answer Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
A3 Look-alike or invented package All answered checks passed Every check passed — 2 of 2. Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
A4 A real dependency turns hostile, or stays broken All answered checks passed Every answered check passed — 8 of 8. 3 more produced no answer. No answer scorecard, bumblebee, openvex — 2 of these only a maintainer's own machine can answer Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
A5 Hijacked build pipeline All answered checks passed Every answered check passed — 9 of 9. 1 more produced no answer. No answer scorecard Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
A6 Compromised developer environment All answered checks passed Every answered check passed — 4 of 4. 2 more produced no answer. No answer signing-model, bumblebee — all of these only a maintainer's own machine can answer Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
A7 Leaked credential All answered checks passed Every check passed — 5 of 5. Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
A8 A flaw in the code you wrote All answered checks passed Every check passed — 3 of 3. Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
A9 Untrustworthy delivery All answered checks passed Every check passed — 7 of 7. Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.

These checks do not stop an attack. They let an outsider tell what a project already does, and where to report a problem. They are not in the list above: best-practices-badge, compliance-map, osps-baseline, publish-targets, secure-repo, security-insights.

Authenticated scan — signature verified

Produced in the repository's own CI and keyless-signed there. Before listing it, the directory verified the Sigstore bundle against the certificate identity https://github.com/p4gs/sscsb-action/.github/workflows/sscsb-scan.yml@refs/heads/main bound to commit c7deeef08747 on 2026-09-03. The repository, the workflow path and the default branch are burned into that certificate by GitHub's OIDC issuer. The record does not assert them.

Re-verify it yourself: scan-record.json · signature bundle

Local scan — signature verified

A maintainer ran sscsb on their own machine and signed the record with their git signing key. The directory verified that detached SSH signature with ssh-keygen -Y verify against .sscsb/policy/allowed_signers fetched from this repository at commit f37f780cb0f2 — committed content the submitter does not supply. Verifying principal 10093271+p4gs@users.noreply.github.com (SHA256:prXatGO56nl8Or4JdDSzIIcj8hZE1jBxnFaXZOnAPDQ) on 2026-09-11.

What that proves, exactly: a holder of a key this repository commits as an approved signer asserts this result at that commit. Nothing more. It is weaker than an authenticated scan, which proves the repository's own CI produced the record.

It contributed 6 controls: commit-signing, ai-trailers, ai-dep-gate, ai-receipts, package-trust, grype. Every other class comes from the repository-observable record. A local scan never overturns one, and never widens the scope it is measured against.

Re-verify it yourself: scan-record.local.json · detached signature

ssh-keygen -Y verify -f allowed_signers \
  -I "10093271+p4gs@users.noreply.github.com" -n sscsb-scan-record \
  -s scan-record.local.json.sig < scan-record.local.json

What the evidence merge found

The local record describes commit f37f780cb0f2, while the repository scan on this listing describes c7deeef08747. Its local-environment rows may predate the code above them.

Two scores are on this page and only one of them is ours. The grade and coverage shown here — A+, 100%, coverage 87.1% — are the DIRECTORY's, computed from every evidence source it holds under the published methodology. The signed local record linked below carries its own score block (A+, 100%, coverage 86.1%): that is the SUBMITTER's self-report, computed on their machine over the controls that machine had in scope. It is republished byte-identically because the signature covers those exact bytes, not because the directory endorses the number.

All controls

Raw sscsb verdicts and every reclassification are shown. Being transparent about what was and was not verifiable is the product. The checks run in six phases, named on the band above each group.

Key pass fail / gap unverified — nobody could answer this check — which is not the same as failing it

Note 1runner-tool availability is the scanner's environment, not the repository's; all registered artifacts pre-exist
Note 2resolved by a signed local scan: this control lives in the development environment, so a workstation record signed by a key this repository commits in .sscsb/policy/allowed_signers is the only evidence that can exist for it
Note 3requires the local development environment; not observable in a repository scan

Jump to phasePhase P1 P2 P3 P4 P5 P6 Hide 13 out-of-scope checks ↑ Top

Control	Verdict	Detail
Phase 1 — Commit integrity11 checks
`secrets`	Pass raw: degraded	runner-tool availability is the scanner's environment, not the repository's… note 1 evidence (3) pre-commit + commit-msg + pre-push shims installed, executable, and unmodified (core.hooksPath=.sscsb/hooks) trufflehog not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 3.95.9. Install: brew install trufflehog (Linuxbrew) or see Release binaries: https://github.com/trufflesecurity/trufflehog/releases (https://github.com/trufflesecurity/trufflehog) gitleaks not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 8.30.1. Install: brew install gitleaks (Linuxbrew) or see Release binaries: https://github.com/gitleaks/gitleaks/releases (https://github.com/gitleaks/gitleaks)
`commit-signing`	Pass raw: pass	resolved by a signed local scan… note 2 evidence (6) pre-commit + commit-msg + pre-push shims installed, executable, and unmodified (core.hooksPath=.sscsb/hooks) 1 approved signer(s), 1 human git config gpg.format = ssh git config user.signingkey = /Users/p4gs/.ssh/github_signing_key.pub signing key does not look hardware-backed (no `-sk`) — spec recommends YubiKey ed25519-sk; software keys weaken the human-accountability model git config commit.gpgSign = true
`agent-signing` out of scope	Info raw: disabled	optional control not enabled by this repository evidence (1) disabled in .sscsb/config.toml
`signing-model`	Unverified raw: degraded	requires the local development environment… note 3 evidence (7) human-local: incomplete — run `sscsb signing setup human-local` agent-claude-code: incomplete — run `sscsb signing setup agent-claude-code` cloud-claude: repo-side attribution is probeable and is not in place — an attestation cannot stand in for it cloud-claude: github_app_installed: not attested — `sscsb signing setup cloud-claude --confirm` github-web: vigilant_mode: not attested — `sscsb signing setup github-web --confirm` github-web: phishing_resistant_mfa: not attested — `sscsb signing setup github-web --confirm` codespaces: gpg_verification: not attested — `sscsb signing setup codespaces --confirm`
`branch-protection`	Pass	evidence (8) main: required pull requests ✓ main: force-push blocking ✓ main: required signed commits ✓ main: required status checks ✓ main: deletion protection ✓ main: Scorecard — stale-review dismissal ✓ main: Scorecard gap — ≥1 required approving review off (needs a 2nd reviewer; a solo maintainer cannot self-approve — opt in with `sscsb harden branch-protection --require-reviews` once you have one) main: Scorecard gap — code-owner review off (needs a 2nd reviewer; a solo maintainer cannot self-approve — opt in with `sscsb harden branch-protection --require-reviews` once you have one)
`actions-audit`	Pass	evidence (1) [info] .github/workflows/release.yml: `slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0` is tag-pinned by design: slsa-github-generator must be referenced by @vX.Y.Z for slsa-verifier to verify the trusted builder
`gittuf` out of scope	Info raw: disabled	optional control not enabled by this repository evidence (1) disabled in .sscsb/config.toml
`ai-trailers`	Pass raw: pass	resolved by a signed local scan… note 2 evidence (2) enforced by the commit-msg hook pre-commit + commit-msg + pre-push shims installed, executable, and unmodified (core.hooksPath=.sscsb/hooks)
`ai-dep-gate`	Pass raw: pass	resolved by a signed local scan… note 2 evidence (2) enforced by the commit-msg hook pre-commit + commit-msg + pre-push shims installed, executable, and unmodified (core.hooksPath=.sscsb/hooks)
`pr-template`	Pass	evidence (1) AI-provenance PR template installed (code/tests/deps/docs questions)
`ai-receipts`	Pass raw: pass	resolved by a signed local scan… note 2 evidence (2) receipts: `sscsb receipt create [commit]` → .sscsb/out/receipts/, `sscsb receipt verify <file>` recomputes the patch digest, re-reads the commit's AI trailers, and verifies any cosign bundle beside the receipt cosign signing of receipts: enabled and cosign available
Phase 2 — Dependencies8 checks
`sbom`	Pass raw: degraded	runner-tool availability is the scanner's environment, not the repository's… note 1 evidence (1) syft not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 1.46.0. Install: brew install syft (Linuxbrew) or see Release binaries: https://github.com/anchore/syft/releases (https://github.com/anchore/syft)
`vuln-scan`	Pass raw: degraded	runner-tool availability is the scanner's environment, not the repository's… note 1 evidence (2) trivy not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 0.72.0. Install: brew install trivy (Linuxbrew) or see Release binaries: https://github.com/aquasecurity/trivy/releases (https://github.com/aquasecurity/trivy) osv-scanner not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 2.4.0. Install: brew install osv-scanner (Linuxbrew) or see Release binaries: https://github.com/google/osv-scanner/releases (https://github.com/google/osv-scanner)
`scorecard`	Unverified raw: degraded	no lane produced a verdict for this control — an unperformed check is never a verdict evidence (2) .github/workflows/scorecard.yml installed live Scorecard results could not be read (none published yet — the workflow runs on push to the default branch — or the code-scanning API refused) — posture unverified
`renovate`	Pass	evidence (1) renovate.json5 installed (7 key(s))
`package-trust`	Pass raw: pass	resolved by a signed local scan… note 2 evidence (5) new-package approval gate enforced in commit-msg hook pre-commit + commit-msg + pre-push shims installed, executable, and unmodified (core.hooksPath=.sscsb/hooks) approved baseline present (0 package(s)) registry existence validation ON for `sscsb deps check` and approvals (anti-slopsquat) typosquat proximity heuristic ON for `sscsb deps check`, approvals, and the commit gate
`bumblebee`	Unverified raw: degraded	requires the local development environment… note 3 evidence (1) bumblebee not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 0.1.2. Install: brew install bumblebee (Linuxbrew) or see Read-only endpoint inventory scanner (Go, zero dependencies). Release binaries: https://github.com/perplexityai/bumblebee/releases — exposur…
`grype`	Pass raw: pass	resolved by a signed local scan… note 2 evidence (1) grype 0.118.0 available — `sscsb scan --grype` runs SBOM-first scanning
`socket-firewall` out of scope	Info raw: disabled	optional control not enabled by this repository evidence (1) disabled in .sscsb/config.toml
Phase 3 — Build receipts10 checks
`sigstore-signing`	Pass	evidence (2) .github/workflows/release-sign.yml not installed — verified by consolidated evidence in .github/workflows/release.yml instead .github/workflows/release.yml job `build`: keyless-signs with `cosign sign-blob --bundle` via `sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6` under `id-token: write`; fires on `push` (tags filter not evaluated)
`slsa-provenance`	Pass	evidence (2) .github/workflows/release-slsa.yml not installed — verified by consolidated evidence in .github/workflows/release.yml instead .github/workflows/release.yml job `provenance`: generates SLSA L3 provenance via `slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0` under `actions: read` + `id-token: write` + `contents: write`; fires on `push` (tags filter not evaluated)
`github-attestations`	Pass	evidence (2) .github/workflows/release-attest.yml not installed — verified by consolidated evidence in .github/workflows/release.yml instead .github/workflows/release.yml job `build`: attests build provenance to GitHub's attestation store with `actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373` under `attestations: write` + `id-token: write`; fires on `push` (tags filter not evaluated)
`sbom-attestation`	Pass	evidence (2) .github/workflows/release-attest-sbom.yml not installed — verified by consolidated evidence in .github/workflows/release.yml instead .github/workflows/release.yml job `build`: attests the SBOM (`sbom-path`) to the artifact digest with `actions/attest@a1948c3f048ba23858d222213b7c278aabede763` under `attestations: write` + `id-token: write`; fires on `push` (tags filter not evaluated)
`model-signing` out of scope	Info raw: disabled	optional control not enabled by this repository evidence (1) disabled in .sscsb/config.toml
`provenance-verify`	Pass raw: degraded	runner-tool availability is the scanner's environment, not the repository's… note 1 evidence (5) slsa-verifier not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 2.7.1. Install: brew install slsa-verifier (Linuxbrew) or see Release binaries: https://github.com/slsa-framework/slsa-verifier/releases (https://github.com/slsa-framework/slsa-verifier) cosign: 3.0.6 gate: `sscsb provenance verify --artifact <f> --provenance <f>.intoto.jsonl --source-uri github.com/<owner>/<repo> --builder-id <trusted builder> [--source-tag vX.Y.Z]` trusted builder pinned in config: https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v2.1.0 deploy-gate workflow present (verification before publish)
`release-immutability`	Pass	evidence (1) .github/workflows/release.yml installed (4 job(s))
`octo-sts`	Pass	evidence (2) .github/workflows/octo-sts-example.yml installed (1 job(s)) .github/chainguard/sscsb-automation.sts.yaml installed (3 key(s))
`harden-runner`	Pass	evidence (8) ci.yml: harden-runner present in job `self-test` codeql.yml: harden-runner present in job `analyze` deploy-gate.yml: harden-runner present in job `verify` octo-sts-example.yml: harden-runner present in job `federated-call` release.yml: harden-runner present in job `build` release.yml: reusable-workflow only — job `provenance` calls `slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0`, where harden-runner is the called workflow's concern release.yml: reusable-workflow only — job `gate` calls `./.github/workflows/deploy-gate.yml`, where harden-runner is the called workflow's concern release.yml: harden-runner present in job `publish`
`witness` out of scope	Info raw: disabled	optional control not enabled by this repository evidence (1) disabled in .sscsb/config.toml
Phase 4 — Code & build hardening7 checks
`sast`	Pass raw: degraded	runner-tool availability is the scanner's environment, not the repository's… note 1 evidence (3) engine: opengrep (rules: /home/runner/work/sscsb-action/sscsb-action/.sscsb/rules) local ruleset present (1 file(s)) opengrep not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 1.25.0. Install: No Homebrew formula; install a pinned release binary: https://github.com/opengrep/opengrep/releases (https://github.com/opengrep/opengrep)
`sighthound` out of scope	Info raw: disabled	optional control not enabled by this repository evidence (1) disabled in .sscsb/config.toml
`codeql`	Pass	evidence (1) .github/workflows/codeql.yml installed (1 job(s))
`fuzzing` out of scope	Info raw: disabled	optional control not enabled by this repository evidence (1) disabled in .sscsb/config.toml
`workflow-audit-extended`	Pass	evidence (1) [info] .github/workflows/release.yml: `slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0` is tag-pinned by design: slsa-github-generator must be referenced by @vX.Y.Z for slsa-verifier to verify the trusted builder
`secure-repo` out of scope	Info	informational control — excluded from scoring
`wait-for-secrets` out of scope	Info raw: disabled	optional control not enabled by this repository evidence (1) disabled in .sscsb/config.toml
Phase 5 — Ongoing posture8 checks
`dependency-track` out of scope	Info raw: disabled	optional control not enabled by this repository evidence (1) disabled in .sscsb/config.toml
`guac` out of scope	Info raw: disabled	optional control not enabled by this repository evidence (1) disabled in .sscsb/config.toml
`openvex`	Unverified raw: info	requires the local development environment… note 3 evidence (3) no OpenVEX documents in .sscsb/out — N/A for this repo until one is generated generate: `sscsb vex create --vuln CVE-… --product pkg:… --status not_affected --justification …` ingest: `sscsb scan --vex <file>` suppresses not_affected/fixed findings visibly
`oras` out of scope	Info raw: disabled	optional control not enabled by this repository evidence (1) disabled in .sscsb/config.toml
`security-insights`	Pass	evidence (1) structurally valid — run `si validate` for full schema conformance
`best-practices-badge`	Pass	evidence (1) .sscsb/best-practices-badge.md installed (present and non-empty; no machine-checkable structure — its substance is a human judgement sscsb does not assert)
`osps-baseline`	Pass	evidence (1) .sscsb/osps-baseline.md installed (present and non-empty; no machine-checkable structure — its substance is a human judgement sscsb does not assert)
`compliance-map` out of scope	Info raw: pass	informational control — excluded from scoring
Phase 6 — Distribution & publishingno checks in this record