ci: remove the daily SCM configuration check workflow - #3522
Merged
Merged
Conversation
The SCM configuration check for this repository moves to the managed check that the Chainloop platform runs. The platform uses its own GitHub App installation token, which can read branch protection and repository security settings. The GitHub Actions job used a token with only contents and metadata read permissions. With that token the gatherer cannot read branch protection, so the check reported that main has no protection rules. Assisted-by: Claude Code Signed-off-by: Javier Rodriguez <javier@chainloop.dev>
Contributor
AI Session Checks —
|
| Scan | Reason |
|---|---|
secret-scan |
no files changed |
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
sast-scan |
no files changed |
iac-scan |
no IaC files changed |
security-context |
no files changed |
PR validation — ✅ 3 passing
| Status | Policy | Material | Messages |
|---|---|---|---|
| ✅ Passed | pr-description-required |
pr-info |
- |
| ✅ Passed | pr-user-story-linked |
pr-info |
- |
| ✅ Passed | pr-min-approvals |
pr-info |
- |
Powered by Chainloop and Chainloop Trace
javirln
marked this pull request as ready for review
October 5, 2026 11:52
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
migmartri
approved these changes
Oct 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR removes the
Daily SCM Configuration CheckGitHub Actions workflow.The SCM configuration check for this repository moves to the managed check that the Chainloop platform runs on a schedule. The platform uses its own GitHub App installation token. This token can read branch protection and the repository security settings.
Since #3260, the workflow token has only
contents: readandmetadata: read. The gatherer needsadministration: readto read branch protection. Without it, the check reported thatmainhas no protection rules, and the branch protection, code review, commit signing and patch management policies failed.After this PR merges, the
CHAINLOOP_GATHERER_APP_IDvariable and theGATHERER_APP_PRIVATE_KEYsecret are not used. You can remove them.Related to https://linear.app/chainloop/issue/PFM-7577
This change was made with the assistance of Claude Code.