From 20f59e1d308c4728a9608db8fa3d1aed3b238b52 Mon Sep 17 00:00:00 2001 From: Simon Thulbourn Date: Tue, 21 Nov 2023 21:35:26 +0100 Subject: [PATCH 1/5] chore(ci): Add OSSF Scorecard Workflow --- .github/workflows/ossf_scorecard.yml | 48 ++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 .github/workflows/ossf_scorecard.yml diff --git a/.github/workflows/ossf_scorecard.yml b/.github/workflows/ossf_scorecard.yml new file mode 100644 index 0000000000..b74a138f69 --- /dev/null +++ b/.github/workflows/ossf_scorecard.yml @@ -0,0 +1,48 @@ +name: Scorecard supply-chain security +on: + # For Branch-Protection check. Only the default branch is supported. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection + branch_protection_rule: + schedule: + - cron: "0 9 * * *" + push: + branches: [develop] + workflow_dispatch: + +permissions: read-all + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + environment: scorecard + permissions: + security-events: write # update code-scanning dashboard + id-token: write # confirm org+repo identity before publish results + + steps: + - name: "Checkout code" + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1 + with: + results_file: results.sarif + results_format: sarif + publish_results: true # publish to OSSF Scorecard REST API + repo_token: ${{ secrets.SCORECARD_TOKEN }} # read-only fine-grained token to read branch protection settings + + - name: "Upload results" + uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard. + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4 + with: + sarif_file: results.sarif From f87c32dfb026aad298efaece1e976b083962792b Mon Sep 17 00:00:00 2001 From: Simon Thulbourn Date: Thu, 23 Nov 2023 10:48:53 +0100 Subject: [PATCH 2/5] Update ossf_scorecard.yml --- .github/workflows/ossf_scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ossf_scorecard.yml b/.github/workflows/ossf_scorecard.yml index b74a138f69..056f021c63 100644 --- a/.github/workflows/ossf_scorecard.yml +++ b/.github/workflows/ossf_scorecard.yml @@ -6,7 +6,7 @@ on: schedule: - cron: "0 9 * * *" push: - branches: [develop] + branches: [main] workflow_dispatch: permissions: read-all From 15f25062f7bc2235a129d376efc76c9b06418232 Mon Sep 17 00:00:00 2001 From: Simon Thulbourn Date: Thu, 23 Nov 2023 11:28:51 +0100 Subject: [PATCH 3/5] removes token as a test --- .github/workflows/ossf_scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ossf_scorecard.yml b/.github/workflows/ossf_scorecard.yml index 056f021c63..765698ffb2 100644 --- a/.github/workflows/ossf_scorecard.yml +++ b/.github/workflows/ossf_scorecard.yml @@ -32,7 +32,7 @@ jobs: results_file: results.sarif results_format: sarif publish_results: true # publish to OSSF Scorecard REST API - repo_token: ${{ secrets.SCORECARD_TOKEN }} # read-only fine-grained token to read branch protection settings + # repo_token: ${{ secrets.SCORECARD_TOKEN }} # read-only fine-grained token to read branch protection settings - name: "Upload results" uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 From f7c7589ee618193e4a630e4ef841c4c45d0bec71 Mon Sep 17 00:00:00 2001 From: Simon Thulbourn Date: Thu, 23 Nov 2023 12:03:04 +0100 Subject: [PATCH 4/5] Update ossf_scorecard.yml --- .github/workflows/ossf_scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ossf_scorecard.yml b/.github/workflows/ossf_scorecard.yml index 765698ffb2..056f021c63 100644 --- a/.github/workflows/ossf_scorecard.yml +++ b/.github/workflows/ossf_scorecard.yml @@ -32,7 +32,7 @@ jobs: results_file: results.sarif results_format: sarif publish_results: true # publish to OSSF Scorecard REST API - # repo_token: ${{ secrets.SCORECARD_TOKEN }} # read-only fine-grained token to read branch protection settings + repo_token: ${{ secrets.SCORECARD_TOKEN }} # read-only fine-grained token to read branch protection settings - name: "Upload results" uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 From 34d5090984df4aba17fb6f0b97608c724d1ac151 Mon Sep 17 00:00:00 2001 From: Simon Thulbourn Date: Thu, 23 Nov 2023 12:08:11 +0100 Subject: [PATCH 5/5] Update ossf_scorecard.yml --- .github/workflows/ossf_scorecard.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ossf_scorecard.yml b/.github/workflows/ossf_scorecard.yml index 056f021c63..78c21427c9 100644 --- a/.github/workflows/ossf_scorecard.yml +++ b/.github/workflows/ossf_scorecard.yml @@ -15,7 +15,7 @@ jobs: analysis: name: Scorecard analysis runs-on: ubuntu-latest - environment: scorecard + # environment: scorecard permissions: security-events: write # update code-scanning dashboard id-token: write # confirm org+repo identity before publish results @@ -32,7 +32,7 @@ jobs: results_file: results.sarif results_format: sarif publish_results: true # publish to OSSF Scorecard REST API - repo_token: ${{ secrets.SCORECARD_TOKEN }} # read-only fine-grained token to read branch protection settings + # repo_token: ${{ secrets.SCORECARD_TOKEN }} # read-only fine-grained token to read branch protection settings - name: "Upload results" uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3