Repository Issue Activity (beta)

#5216 BUG: GitHub's self-repository syntax reported as unpinned dependencies

#5090 GitHub Actions dependencies reported as "unknown license" despite having valid MIT licenses

#5232 Feature - Pinned-Dependencies support self-repository GitHub actions syntax

#5234 BUG: Vulnerabilities check no longer disables Python transitive resolution after the osv-scanner v2.3.2 bump

#5133 BUG: Packaging check's ko matcher requires BOTH setup-ko spellings in one job, so ko publishing is never detected

#3915 Dangerous Workflow: some user input are not being detected as untrusted input.

#4716 Recursive GH workflow traversal

#5224 Serialization error when rendering results attestation

#5208 [IMPORTANT] Scorecard Infrastructure Changes

#5214 BUG: unconditional ListCommits makes Scorecard unusable with a GitHub App installation token

#5168 Feature: Packaging check should detect winget publishing workflows

#5188 Packaging check should recognize gh release create workflows

#3678 Allow merge queue instead of an up to date branch for the branch protection check

#5207 PinnedDependenciesID should recognize GitHub actions.lock enforcement

#5206 BUG: Code-Review treats any merged PR with an approved/lgtm label as reviewed, ignoring the PR's actual reviews

#4667 [Feature] Support GitHub Attestations with artifacts for Signed-Releases

#5198 BUG: Security-Policy scores the contents of an unrelated security.md found elsewhere in the tree

#5201 Packaging check does not recognize GitHub CLI and Nextcloud App Store publishing workflows

#5182 BUG: Overlapping content in scorecard.dev

#2132 Differentiate between commit SHA and tag SHA

#5196 Front page layout is broken

#5193 Go fuzz build fails with GOMODCACHE overlay

#5170 BUG: Token-Permissions ignores packages: write for non-GitHub publishing workflows

#5149 BUG: CI-Tests misses successful CI when checkSuites exceed the first 30

#898 check information in README.md and other docs should be programmatically generated from checks.md