# OpenSSF Scorecard Configuration

# See https://github.com/ossf/scorecard/tree/main/config

annotations:

# Binary artifacts required for Unity hot-update framework:

# - HybridCLR Plugin: Native DLLs for IL2CPP hot-update

# - YooAsset Bundles: Sample project assets

# - AOT Compiled DLLs: Unity engine module references

# These are from trusted sources and essential for the framework

- checks:

- binary-artifacts

reasons:

- reason: not-applicable # Unity framework requires platform-specific binaries that cannot be built from source

# Pinned dependencies: Using version tags (@v4) for maintainability

# SHA pinning would make updates more difficult with minimal security benefit

# for this Unity project that doesn't process untrusted input

- checks:

- pinned-dependencies

reasons:

- reason: not-applicable # Version tags preferred for maintainability in Unity project

# Dependency update tools like Dependabot don't work well with Unity/OpenUPM

- checks:

- dependency-update-tool

reasons:

- reason: not-supported # Unity uses OpenUPM which is not supported by Dependabot/Renovate

# Fuzzing is not practical for Unity C# game framework code

- checks:

- fuzzing

reasons:

- reason: not-applicable # Unity C# framework is not suited for traditional fuzzing

# SAST is handled by CodeQL but may not be fully detected

- checks:

- sast

reasons:

- reason: not-detected # CodeQL is configured but may not be recognized

# Token permissions: Write permissions required for CI functionality

# - checks: write - GameCI publishes test results as check runs

# - statuses: write - Setting commit status for branch protection

# - pull-requests: write - Commenting test results on PRs

# - contents: write - Release workflow creates tags and commits

- checks:

- token-permissions

reasons:

- reason: not-applicable # Write permissions required for test reporting and release automation

# Branch protection: Using GitHub Rulesets with auto-approve bot

# - Rulesets require 1 approver (provided by auto-approve bot)

# - Code owner review is required

# - last_push_approval enabled (bot approval counts as different user from pusher)

# - bypass_actors: [] prevents admin bypass (equivalent to "apply to administrators")

# Scorecard may not fully recognize ruleset settings vs classic branch protection

- checks:

- branch-protection

reasons:

- reason: not-applicable # Using Rulesets; Scorecard may not recognize all settings