chore(superagent): disable contributor-trust scoring, keep the security scan - #8684
Merged
Merged
Conversation
…ty scan The trustedAuthors exemption does not work (shin-core is listed and was still flagged action_required, 10/100 'dangerous'), and the verdict now has no consumer: LoopOver lists this check under gate.ignoredCheckRuns on all three gate repos, so a non-passing result no longer gates, pends, or holds anything. It only produced a permanently red check on contributor PRs that nothing acts on. prScan stays enabled and still gates CI normally.
Contributor
|
Important 🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨 ⏳ LoopOver is waiting…LoopOver has seen this pull request and is waiting on CI checks to finish before reviewing it. This comment will update once the review runs. 🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟨 Waiting |
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
It provably does not work (shin-core was listed and still flagged action_required) and is inert with contributorTrust disabled. Keeping it would only suggest a working exemption mechanism that does not exist.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8684 +/- ##
=======================================
Coverage 97.86% 97.86%
=======================================
Files 423 423
Lines 29818 29818
Branches 11180 11180
=======================================
Hits 29181 29181
Misses 143 143
Partials 494 494 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mirror of JSONbored/loopover#9818.
The
Contributor trustcheck postsaction_requiredon established contributors' PRs (shin-core: 10/100 "dangerous" — despite being listed intrustedAuthors, so that exemption does not work). Its verdict also has no consumer any more: LoopOver lists this check undergate.ignoredCheckRunson all three gate repos, so a non-passing result no longer gates, pends, or holds anything. Leaving it enabled only produces a permanently red check on contributor PRs that nothing acts on.prScan(Superagent Security Scan) stays enabled and still gates CI normally — that's the protection worth keeping, and it's a different check from the same app.trustedAuthorskept but inert so the history survives.