Source: The Hand HIGH (OpenSSF Scorecard)
Finding: Every commit on master in the last 50 commits shows N (no signature) in git log --pretty=format:'%G?'. Combined with the commit-message quality (commit, commit, commit, fixup, update!), strong evidence that master is not protected with "require signed commits" and almost certainly not "require linear history" or "require status checks before merging."
Remediation: Settings → Branches → Add rule for master:
- Require PR review
- Require status checks (CI)
- Require linear history
- Restrict force-push
- Restrict direct push
- (Optionally) require signed commits
Source: The Hand HIGH (OpenSSF Scorecard)
Finding: Every commit on master in the last 50 commits shows
N(no signature) ingit log --pretty=format:'%G?'. Combined with the commit-message quality (commit,commit,commit,fixup,update!), strong evidence that master is not protected with "require signed commits" and almost certainly not "require linear history" or "require status checks before merging."Remediation: Settings → Branches → Add rule for master: