From a1c1fc8244364114e6f21d08a94c17a31bad9044 Mon Sep 17 00:00:00 2001 From: Gabriela Gutierrez Date: Fri, 23 Sep 2022 15:42:20 -0300 Subject: [PATCH 1/5] Create scorecards.yml Signed-off-by: Gabriela Gutierrez --- .github/workflows/scorecards.yml | 51 ++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 .github/workflows/scorecards.yml diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml new file mode 100644 index 000000000..fb7acf66a --- /dev/null +++ b/.github/workflows/scorecards.yml @@ -0,0 +1,51 @@ +name: Scorecards supply-chain security +on: + # Only the default branch is supported. + branch_protection_rule: + schedule: + - cron: '25 18 * * 5' + push: + branches: [ "main" ] + +# Declare default permissions as read only. +permissions: read-all + +jobs: + analysis: + name: Scorecards analysis + runs-on: ubuntu-latest + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + # Used to receive a badge. + id-token: write + + steps: + - name: "Checkout code" + uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@865b4092859256271290c77adbd10a43f4779972 # tag=v2.0.3 + with: + results_file: results.sarif + results_format: sarif + # Publish the results for public repositories to enable scorecard badges. For more details, see + # https://github.com/ossf/scorecard-action#publishing-results. + publish_results: true + + # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF + # format to the repository Actions tab. + - name: "Upload artifact" + uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # tag=v3.0.0 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard. + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26 + with: + sarif_file: results.sarif From 9a628bb1c8511fc166ac102f25209b1931e1a1b6 Mon Sep 17 00:00:00 2001 From: Gabriela Gutierrez Date: Fri, 23 Sep 2022 17:07:46 -0300 Subject: [PATCH 2/5] Add OpenSSF Scorecard badge to README.md Signed-off-by: Gabriela Gutierrez --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 8b89bb01e..5fa6cc49e 100644 --- a/README.md +++ b/README.md @@ -14,6 +14,7 @@ examples and guides.

[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/486/badge)](https://bestpractices.coreinfrastructure.org/projects/486) [![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/prometheus/prometheus) [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/prometheus.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:prometheus) +[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/prometheus/prometheus/badge)](https://api.securityscorecards.dev/projects/github.com/prometheus/prometheus) From 17caa505b1b6caff26b17d11ddbfb90c6763a54a Mon Sep 17 00:00:00 2001 From: Gabriela Gutierrez Date: Fri, 23 Sep 2022 17:28:30 -0300 Subject: [PATCH 3/5] Add Google copyright notice Signed-off-by: Gabriela Gutierrez --- .github/workflows/scorecards.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index fb7acf66a..66ef760e8 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -1,3 +1,5 @@ +# Copyright 2022 Google LLC + name: Scorecards supply-chain security on: # Only the default branch is supported. From 6237aba7c4d79c793530bf119078f60cd96fec97 Mon Sep 17 00:00:00 2001 From: Gabriela Gutierrez Date: Fri, 23 Sep 2022 17:49:51 -0300 Subject: [PATCH 4/5] Fix trailing spaces Signed-off-by: Gabriela Gutierrez --- .github/workflows/scorecards.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 66ef760e8..ef784e1fb 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -21,7 +21,7 @@ jobs: security-events: write # Used to receive a badge. id-token: write - + steps: - name: "Checkout code" uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0 @@ -34,7 +34,7 @@ jobs: results_file: results.sarif results_format: sarif # Publish the results for public repositories to enable scorecard badges. For more details, see - # https://github.com/ossf/scorecard-action#publishing-results. + # https://github.com/ossf/scorecard-action#publishing-results. publish_results: true # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF @@ -45,7 +45,7 @@ jobs: name: SARIF file path: results.sarif retention-days: 5 - + # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26 From 19b4cb2f48d585c8d6371f1e5f9579035eac978c Mon Sep 17 00:00:00 2001 From: Julien Pivotto Date: Fri, 29 Sep 2023 13:20:32 +0200 Subject: [PATCH 5/5] OpenSSF: Run on main and PR's Signed-off-by: Julien Pivotto --- .github/workflows/scorecards.yml | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index ef784e1fb..716555e8a 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -2,10 +2,7 @@ name: Scorecards supply-chain security on: - # Only the default branch is supported. - branch_protection_rule: - schedule: - - cron: '25 18 * * 5' + pull_request: push: branches: [ "main" ] @@ -29,13 +26,13 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@865b4092859256271290c77adbd10a43f4779972 # tag=v2.0.3 + uses: ossf/scorecard-action@08b4669551908b1024bb425080c797723083c031 # tag=v2.2.0 with: results_file: results.sarif results_format: sarif # Publish the results for public repositories to enable scorecard badges. For more details, see # https://github.com/ossf/scorecard-action#publishing-results. - publish_results: true + publish_results: ${{ github.event_name != 'pull_request' }} # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab.