From 2d3c77d53a5ccca4088cb1d90421915349a4fa2a Mon Sep 17 00:00:00 2001
From: Tak Tran <contact@tutaktran.com>
Date: Mon, 24 Aug 2026 11:10:22 +0100
Subject: [PATCH 1/3] AG-3390 - Read the scorecard from api.scorecard.dev, not
 the deprecated host (#14940)

The check fetched `api.securityscorecards.dev`, the pre-OpenSSF hostname. Its CDN
edge is serving objects days past their 10-minute max-age, so the gate reported a
stale score that disagreed with the viewer.

Switch to `api.scorecard.dev` and add a cache-buster, since the new host has the
same 10-minute max-age and could go stale the same way. A `Cache-Control:
no-cache` request header does not help - the edge ignores it.

Also record the scan date in the CTRF message, so a stale read is visible in the
Slack notification rather than only in the GitHub step summary.

Mirrors the same change in ag-charts, so the ag-shared subrepo stays consistent.
---
 .../ag-shared/scripts/ossf-scorecard/getAndCheckResults.mjs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/external/ag-shared/scripts/ossf-scorecard/getAndCheckResults.mjs b/external/ag-shared/scripts/ossf-scorecard/getAndCheckResults.mjs
index 7829e07944e..4a5f4c05633 100644
--- a/external/ag-shared/scripts/ossf-scorecard/getAndCheckResults.mjs
+++ b/external/ag-shared/scripts/ossf-scorecard/getAndCheckResults.mjs
@@ -6,8 +6,8 @@ export async function getOSSFScorecardResults({ project, threshold }) {
         process.exit(1);
     }
 
-    const scorecardJsonUrl = `https://api.securityscorecards.dev/projects/github.com/ag-grid/ag-${project}`;
-    const response = await fetch(scorecardJsonUrl);
+    const scorecardJsonUrl = `https://api.scorecard.dev/projects/github.com/ag-grid/ag-${project}`;
+    const response = await fetch(`${scorecardJsonUrl}?cachebust=${Date.now()}`);
     const results = await response.json();
 
     const score = results.score;
@@ -37,7 +37,7 @@ export async function getOSSFScorecardResults({ project, threshold }) {
             tests: [
                 {
                     name: `OpenSSF Score >= ${threshold}`,
-                    message: `Score = ${score}, from ${scorecardJsonUrl}. See ${resultsUrl} for full details.`,
+                    message: `Score = ${score}, scanned ${results.date}, from ${scorecardJsonUrl}. See ${resultsUrl} for full details.`,
                     status,
                     duration: 0,
                 },

From 8cc134006fe74f2f7ea2db41659a30e0c4ca8e32 Mon Sep 17 00:00:00 2001
From: Alan Treadway <alantreadway@users.noreply.github.com>
Date: Mon, 24 Aug 2026 12:11:03 +0100
Subject: [PATCH 2/3] Add CI-read scopes to the agent-run job permissions
 (#14939)

AG-17426
---
 .github/workflows/jira-agent-pipeline.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/jira-agent-pipeline.yml b/.github/workflows/jira-agent-pipeline.yml
index df2c6a679d4..a84258a9fc0 100644
--- a/.github/workflows/jira-agent-pipeline.yml
+++ b/.github/workflows/jira-agent-pipeline.yml
@@ -186,6 +186,9 @@ jobs:
         permissions:
             contents: read
             packages: read
+            pull-requests: read
+            checks: read
+            statuses: read
         steps:
             - uses: actions/checkout@v4
               with:

From 1e26b71a7039f15dcadb5d5d0851de724a6acdab Mon Sep 17 00:00:00 2001
From: Guilherme Lopes <guilherme@gwm-solutions.com>
Date: Mon, 24 Aug 2026 10:39:02 -0300
Subject: [PATCH 3/3] fixed claude settings (#14943)

---
 .claude/settings.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.claude/settings.json b/.claude/settings.json
index 47a56e14ef6..77967fc4346 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -86,7 +86,8 @@
     ],
     "deny": [
       "Read(.env.local)",
-      "Read(credentials/)"
+      "Read(credentials/)",
+      "Read(credentials/**)"
     ]
   },
   "hooks": {