It was already enabled for junit-plugin, support-core-plugin, and mercurial-plugin from other requests.

Did you leave these out deliberate?

• jenkinsci/maven-hpi-plugin
• jenkinsci/parameterized-scheduler-plugin
• jenkinsci/plugin-installation-manager-tool

Note that if you don't consider yourself to be a maintainer of these, you can always remove yourself from the files

Security team only link: https://github.com/jenkinsci-cert/cert-automation/pull/33

Once I get this PR reviewed, I will merge it. Within a day, security findings should appear in individual repos.

I actually grepped plugins only. You can indeed add maven-hpi-plugin if you can.

I'm going to remove myself from parameterized-scheduler and plugin-installation-manager-tool.

Oops, I misread maven-hpi-plugin as maven-plugin. Adding Jenkins scanning to the former isn't useful.

Repo list additions were merged. This should be part of the next scheduled run, not sure when that is and VPN is inaccessible so I cannot check