From 051ac9b562554550f112321cff33783e957300b9 Mon Sep 17 00:00:00 2001 From: Derek Lewis Date: Sat, 19 Sep 2026 04:52:33 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=8F=97=EF=B8=8F=E2=9C=A8=EF=BC=9Agrade=20?= =?UTF-8?q?the=20defaults=20security=20practices?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The SDK has been graded by OpenSSF Scorecard since it started running its own workflow, and this repository has not, although the practices the grade measures are largely decided here: the branch protection, the pinned actions, the token permissions every repository inherits. Whoever arrives from a published package and follows the metadata back here finds the community health files without the grade that the code carries. The same workflow answers that, and it needs nothing this repository does not already have: no secret, no app, and the analysis waits on a public repository rather than failing until there is one. The result is pinned to the same commit of `github/codeql-action` that `codeql-analysis.yml` already uses, so the two move together when renovate moves them. Signed-off-by: Derek Lewis Assisted-by: Claude-Code:claude-opus-5 Refs: https://github.com/OpenINF/.github/issues/178 --- .github/workflows/scorecard.yml | 51 +++++++++++++++++++++++++++++++++ project-terms.txt | 3 ++ 2 files changed, 54 insertions(+) create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 00000000..5de54901 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,51 @@ +# Grading this repository's security practices, the same way the SDK does. +# +# OpenSSF Scorecard reads branch protection, pinned dependencies, token +# permissions, SAST coverage and the rest, and publishes the result to the +# Security tab. Whoever arrives from an OpenINF package and follows it back +# here sees the same grade the SDK carries, which is the point of grading the +# defaults alongside the code that inherits them. +# +# It needs a public repository: the checks read history through an API the +# default token cannot reach on a private one, and publishing a result is +# public by definition. The job waits for that rather than failing until then. +# +# Actions are pinned by commit, never by tag. +name: Scorecard + +on: + branch_protection_rule: + push: + branches: [main] + schedule: + # Monday, clear of the other scheduled runs. + - cron: '17 5 * * 1' + +permissions: {} + +jobs: + analysis: + name: Scorecard analysis + if: ${{ !github.event.repository.private }} + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write # upload the SARIF result + id-token: write # sign the result so it can be published + steps: + - name: Check out project repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run analysis + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + with: + results_file: results.sarif + results_format: sarif + publish_results: true + + - name: Upload result to the Security tab + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + with: + sarif_file: results.sarif diff --git a/project-terms.txt b/project-terms.txt index 4d0bee5b..34943474 100644 --- a/project-terms.txt +++ b/project-terms.txt @@ -68,6 +68,7 @@ onopentag OpenINF openinf openpgp +ossf recompiles remarkrc Renovatebot @@ -78,6 +79,8 @@ retarget retargets returntocorp rubocop +SARIF +sarif screencap sdcard SEMGREP