Merge pull request #1060 from jantiebot/main

fix: only get scorecard levels if user wants to see the OpenSSF scorecard
2026-02-27 15:05:18 -08:00
parent 5ecdc4b578 24398f008e
commit 57a3d46a7b
1 changed files with 5 additions and 2 deletions
--- a/src/main.ts
+++ b/src/main.ts
@@ -186,8 +186,11 @@ async function run(): Promise<void> {
    )

    // generate informational scorecard entries for all added changes in the PR
-    const scorecardChanges = getScorecardChanges(changes)
-    const scorecard = await getScorecardLevels(scorecardChanges)
+    let scorecard: Scorecard = {dependencies: []}
+    if (config.show_openssf_scorecard) {
+      const scorecardChanges = getScorecardChanges(changes)
+      scorecard = await getScorecardLevels(scorecardChanges)
+    }

    const minSummary = summary.addSummaryToSummary(
      vulnerableChanges,