{"date":"2022-08-15","repo":{"name":"github.com/microsoft/BuildXL","commit":"3fc420604c274f96a444e5471305e5bfe4ceb45b"},"scorecard":{"version":"v4.5.0-26-g10b6052","commit":"10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93"},"score":5.7,"checks":[{"name":"Maintained","score":10,"reason":"30 commit(s) out of 30 and 2 issue activity out of 30 found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93/docs/checks.md#maintained"}},{"name":"Code-Review","score":0,"reason":"no reviews found","details":["Warn: no reviews found for commit: 3fc420604c274f96a444e5471305e5bfe4ceb45b","Warn: no reviews found for commit: a6be68ae5847fe1a3776d709a026cffdbe91bfcd","Warn: no reviews found for commit: 9ad8a18d7cd2e8e23eaab69a8f1f41d58c8e5cd7","Warn: no reviews found for commit: cab2152c366787028f2ebf88d595df7a5badac28","Warn: no reviews found for commit: 67e951bb4b94b43a1829f98059aadf9902ad929b","Warn: no reviews found for commit: 3ecd6d1f81a0bcc69b47acddf985e2c04ea62965","Warn: no reviews found for commit: bb5dded32ae9500b49175644de124be757c7e72f","Warn: no reviews found for commit: 47d275f00bcc2a13df2585c8268386dc15901a62","Warn: no reviews found for commit: 019f294ad98f18ffa419009a8e87e0606af0ab8c","Warn: no reviews found for commit: dcbbccbe64cfe3003ba952038f4af8dbee57d12f","Warn: no reviews found for commit: 4feca32e66a4336491419ea3414e7dadc6d660db","Warn: no reviews found for commit: 19717469ca2ac160bb80eb4c4b020d6a04db661e","Warn: no reviews found for commit: 06dfb5864baeba46170a44aee4bfe734e9219ad0","Warn: no reviews found for commit: 56ba6669f107d198b0fc4069eaa1b8160c5df3db","Warn: no reviews found for commit: 8792dbdd5fc67b3560d25dc4c14f9756057cc6d2","Warn: no reviews found for commit: 61693bc4e19569cd4759f41ce93caf9b92af9b87","Warn: no reviews found for commit: c9146dd0c551a6c97f533c72dbc57e64ee0e5d1d","Warn: no reviews found for commit: 1a1a685f5806567b5b53b03432f1bfcd3eda51e7","Warn: no reviews found for commit: c00ba90299a0dfc339f2d1fa7c10999e61bd9f92","Warn: no reviews found for commit: bd21ddd7c8dc5017c7b655ab21f9d982a206dd8e","Warn: no reviews found for commit: bd87687e0248c4649ea591378894611af0d5bdb3","Warn: no reviews found for commit: 25c66486c1237db8e2e1c40df49238e27dbbd309","Warn: no reviews found for commit: a206bac369abde868059af264e026148f8422518","Warn: no reviews found for commit: 1e353a679a36276c30a54e9d2da0293f7518785e","Warn: no reviews found for commit: b29d9c47e567f51af3781e7d7bb324ac2c7f0a09","Warn: no reviews found for commit: 82c6e2c9aefe01681890847096aa4236e4d919e1","Warn: no reviews found for commit: d5aadda53a7c7ffbe7e0eb8c678b3fcd585cb5d2","Warn: no reviews found for commit: 1cace877599ab9f19f831f46ee14aaa789416ae1","Warn: no reviews found for commit: 3af5aae1073cf31b9a3b1b7e520650a0cb121567","Warn: no reviews found for commit: 3de730b46b8c12fab758c08b935437b4cfdf8140"],"documentation":{"short":"Determines if the project requires code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93/docs/checks.md#code-review"}},{"name":"CII-Best-Practices","score":0,"reason":"no badge detected","details":null,"documentation":{"short":"Determines if the project has a CII Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93/docs/checks.md#cii-best-practices"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93/docs/checks.md#vulnerabilities"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":1,"reason":"branch protection is not maximal on development and all release branches","details":["Warn: 'force pushes' enabled on branch 'master'","Info: 'allow deletion' disabled on branch 'master'","Info: status check found to merge onto on branch 'master'","Warn: number of required reviewers is only 1 on branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93/docs/checks.md#branch-protection"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy detected in current repo: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93/docs/checks.md#security-policy"}},{"name":"Token-Permissions","score":10,"reason":"tokens are read-only in GitHub workflows","details":null,"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93/docs/checks.md#token-permissions"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93/docs/checks.md#packaging"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: : LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93/docs/checks.md#license"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93/docs/checks.md#dangerous-workflow"}},{"name":"Pinned-Dependencies","score":10,"reason":"all dependencies are pinned","details":["Info: GitHub-owned GitHubActions are pinned","Info: Third-party GitHubActions are pinned","Info: Dockerfile dependencies are pinned","Info: no insecure (not pinned by hash) dependency downloads found in Dockerfiles","Info: no insecure (not pinned by hash) dependency downloads found in shell scripts"],"documentation":{"short":"Determines if the project has declared and pinned its dependencies.","url":"https://github.com/ossf/scorecard/blob/10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93/docs/checks.md#pinned-dependencies"}},{"name":"Binary-Artifacts","score":2,"reason":"binaries present in source code","details":["Warn: binary detected: Public/Src/Cache/Script/NetCore/VersionUpdater/VersionUpdater.dll:1","Warn: binary detected: Shared/Tools/Microsoft.IdentityModel.Clients.ActiveDirectory.dll:1","Warn: binary detected: Shared/Tools/Newtonsoft.Json.dll:1","Warn: binary detected: Shared/Tools/NuGet.Common.dll:1","Warn: binary detected: Shared/Tools/NuGet.Protocol.dll:1","Warn: binary detected: Shared/Tools/NuGet.exe:1","Warn: binary detected: Shared/Tools/PowerArgs.dll:1","Warn: binary detected: Shared/Tools/crc.exe:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93/docs/checks.md#binary-artifacts"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":null,"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93/docs/checks.md#fuzzing"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: dependabot config file not detected in source location.\n\t\t\tWe recommend setting this configuration in code so it can be easily verified by others.","Warn: renovatebot config file not detected in source location.\n\t\t\tWe recommend setting this configuration in code so it can be easily verified by others."],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/10b6052acfb4f0b8136bc4876cb6f5b6f26bfe93/docs/checks.md#dependency-update-tool"}}]}