On this page
ADR-0044: Security workflows probe for code scanning and fall back to artifacts
Status: Accepted (WP-70d). Implemented in .github/scripts/github-feature.sh, .github/scripts/sarif-summary.sh and the security, projects and projects-rescan workflows.
Context
The first runs on GitHub (2026-11-10) failed in steps that upload SARIF results, run dependency review and run OpenSSF Scorecard. The repository is private and GitHub Advanced Security is not enabled: the code-scanning API answers 403, dependency review is unsupported, and Scorecard cannot read a private repository with the workflow token. These failures said nothing about the code.
Decision
- Before using a feature, a job asks the API the feature itself uses
(
github-feature.sh code-scanning,dependency-review, visibility). Answers it cannot classify fail the job, so a missing workflow permission is not mistaken for a missing feature. - Code scanning available: upload SARIF as before. Unavailable: a notice with the reason,
the SARIF attached as a workflow artifact (
sarif-*), the results listed in the job summary, error-level results as annotations. - Dependency review unavailable: a notice; vulnerable dependencies of a pull request are still caught by cargo-audit, pnpm audit and the Trivy filesystem scan.
- Scorecard runs only when the repository is public; a prerequisites job logs why it was skipped.
- The SARIF fallback never gates; the gates (Trivy filesystem scan, image scan gates) stay separate steps, as they were with code scanning.
Consequences
- The
securityworkflow has been green on every push since commit 7ce0cb7, with the notices, but no code-scanning alert exists anywhere: results live in workflow artifacts and job summaries that nobody is notified about. Enabling GitHub Code Security (or making the repository public) is a decision for the repository owners (see repository settings). - The same probe decides whether arm64 jobs run (
platforms.sh): only when the repository is public orCL_ARM64_RUNNERnames a runner.