Site repo for SSCS Bootstrapper.
/— SSCS Bootstrapper homepage + the public scan directory (submit any public repo for an external sscsb scan, or publish an authenticated one with sscsb-action)/directory/— the scan directory/methodology/— how a grade is computed
The site moved from tools.sensiblesecurity.xyz/sscsb/ to the root of
sscsb.dev; the umbrella tools landing page that used to sit at / retired
with the move.
The site is a bun + TypeScript static build (site/), deployed by
.github/workflows/pages.yml. The deploy is this repo's release: the build
is packed to one site.tar.gz, keyless-signed (Cosign), attested (GitHub
build provenance + CycloneDX SBOM) and given SLSA Build L3 provenance
(slsa-github-generator), and .github/workflows/deploy-gate.yml verifies all
three trails before the verified bytes reach Pages. Re-verify any deploy from
its run artifacts: gh attestation verify site.tar.gz --repo p4gs/p4gs.github.io.
Scan records live in site/data/repos/;
every record lands via a maintainer-reviewed PR. Scoring is documented at
/methodology/.
Authenticated records that arrive signed (sscsb-action with id-token: write) are verified at ingest against the producing repository's workflow
identity — OWNER/REPO/.github/workflows/sscsb-scan.yml on its live default
branch — and listed as ✓ verified, with the Sigstore bundle published beside
the record (site/data/trust/) so anyone can re-verify. Unsigned
authenticated records are listed as unverified claims. Trust model:
/methodology/#trust.
Repositories that run sscsb-scan.yml can skip the cross-repo submission
token entirely: add owner/repo to site/data/registry.json by PR and
directory-collect.yml polls the run, files the submission issue with this
repo's own token, and dispatches ingest.