outcome-receipts/waivers.yml at fix/eval-multi-template-118 · ghzhost/outcome-receipts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
version: 1

waivers:
  - id: WVR-003
    control: SEC-10
    repo: outcome-receipts
    kind: semgrep
    reason: >-
      The registry profile applies a Python-below-3.7 compatibility rule to a
      Python-3.12-only package. importlib.resources is the correct standard-
      library API for packaged gettext catalogs; issue 53 owns retirement.
    owner: chelseakr
    granted: 2026-07-12
    expires: 2026-10-12
    link: https://github.com/ChelseaKR/outcome-receipts/issues/53

  - id: WVR-004
    control: CQ-35
    repo: outcome-receipts
    kind: other
    reason: >-
      Ruff S608 flags trusted dynamic identifiers and author-controlled report
      SQL even where identifiers are quoted and values are bound. Suppressions
      are per-line, issue-linked, and reviewed under issue 52.
    owner: chelseakr
    granted: 2026-07-12
    expires: 2026-10-12
    link: https://github.com/ChelseaKR/outcome-receipts/issues/52

  - id: WVR-005
    control: SEC-34
    repo: outcome-receipts
    kind: other
    reason: >-
      OpenSSF Branch-Protection scores 4 because GitHub cannot count the sole
      maintainer's self-review. The live ruleset still requires pull requests,
      signed linear history, resolved threads, strict checks, and no bypass.
      ADR 0002 requires raising the review count when a second maintainer exists.
    owner: chelseakr
    granted: 2026-07-12
    expires: 2026-10-12
    link: docs/adr/0002-solo-maintainer-review-count.md

  - id: WVR-006
    control: SEC-37
    repo: outcome-receipts
    kind: other
    reason: >-
      Re-measured 2026-08-21 (was 6.8 on 2026-07-12): the aggregate is 7.1
      while OpenSSF assigns zero Maintained score to repositories under 90
      days old and zero Code-Review score to a solo maintainer's own
      unreviewed changes. Critical checks are at target and the workflow
      ratchets to 7.0 without permitting regression back toward the old
      floor. Expiry is shortened, not extended, to the date the Maintained
      premise itself stops applying; Code-Review and CII-Best-Practices are
      expected to still hold the aggregate under the portfolio's 8.0 target
      after that, so a renewed (not necessarily retired) waiver is the
      expected outcome, not an assumption this reaches 8.0 unassisted.
    owner: chelseakr
    granted: 2026-08-21
    expires: 2026-09-25
    link: docs/audits/openssf-scorecard-2026-08-21.md