openssf best practices: passing