Security / supply chain
Defences against vulnerable code and a compromised build pipeline: continuous static analysis and posture scanning (CodeQL, OpenSSF Scorecard), dependency update automation, SLSA provenance for the released artifact, SHA-pinned GitHub Actions, and — when its cache is present — the live, externally measured OpenSSF Scorecard grade.
4.3 / 512.12 of 14 weighted points earned — snapshot of 2026-08-04
codeqlweight 2 ptsearned 2 / 2
Measures: CodeQL workflow present
Why this weight: Continuous static vulnerability analysis on every change — one of the two always-on scanners this dimension leans on.
scorecardweight 2 ptsearned 2 / 2
Measures: OpenSSF Scorecard workflow present
Why this weight: Continuously re-measures the repo’s supply-chain posture against an open industry standard, catching regressions the presence checks here would miss.
dependabotweight 1 ptearned 1 / 1
Measures: Dependabot configured
Why this weight: Automated dependency updates are important hygiene but nearly free to set up, so mere presence earns the least.
slsa-provenanceweight 2 ptsearned 2 / 2
Measures: SLSA build provenance attested for the release artifact
Why this weight: Provenance lets downstream users verify the published .vsix came from this repo’s CI — protection that extends beyond the repo itself.
pinned-actionsweight 3 ptsearned 3 / 3
Measures: GitHub Actions pinned to a full commit SHA
Why this weight: An unpinned action is arbitrary third-party code execution inside CI — the most direct supply-chain risk here — and the ratio moves with every workflow edit, so it outweighs the presence checks.
ossf-scorecard-gradeweight 4 ptsearned 2.12 / 4
Measures: live OpenSSF Scorecard grade /10 (offline cache; refresh with npm run maturity:ossf)
Why this weight: The one externally *measured* grade in the dimension — independent and continuous rather than self-reported presence — so it carries the most weight; skipped entirely when no offline cache exists, to keep the scorer deterministic.