Pete Wagner

> I can set the subject-path input to dist/gh* FWIW that's what we did: https://github.com/Shopify/ejson/pull/146/files I appreciate GitHub encoding it as a pattern for goreleaser projects 🚀 .

For GitHub+CodeQL specifically, I think scorecard could also consider this API endpoint: https://docs.github.com/en/rest/code-scanning/code-scanning?apiVersion=2022-11-28#get-a-code-scanning-default-setup-configuration--status-codes The downside is that it needs `administration:read` permission on the repository. #### Disabled: ```json { "state": "not-configured",...