From 43aaa67992a0076a9989897a1d91a1715e31ae35 Mon Sep 17 00:00:00 2001
From: John Bohannon <imjohnbo@kit.com>
Date: Thu, 14 Nov 2024 12:37:05 -0600
Subject: [PATCH 1/4] Create scorecard.yml
---
.github/workflows/scorecard.yml | 62 +++++++++++++++++++++++++++++++++
1 file changed, 62 insertions(+)
create mode 100644 .github/workflows/scorecard.yml
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 0000000..3a9bb95
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,62 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+ # For Branch-Protection check. Only the default branch is supported. See
+ # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+ branch_protection_rule:
+ # To guarantee Maintained check is occasionally updated. See
+ # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+ schedule:
+ - cron: '25 17 * * 4'
+ push:
+ branches: [ "main" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+ analysis:
+ name: Scorecard analysis
+ runs-on: ubuntu-latest
+ permissions:
+ # Needed to upload the results to code-scanning dashboard.
+ security-events: write
+ # Needed to publish results and get a badge (see publish_results below).
+ id-token: write
+
+ steps:
+ - name: "Checkout code"
+ uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+ with:
+ persist-credentials: false
+
+ - name: "Run analysis"
+ uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+ with:
+ results_file: results.sarif
+ results_format: sarif
+
+ # Public repositories:
+ # - Publish results to OpenSSF REST API for easy access by consumers
+ # - Allows the repository to include the Scorecard badge.
+ # - See https://github.com/ossf/scorecard-action#publishing-results.
+ publish_results: true
+
+ # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+ # format to the repository Actions tab.
+ - name: "Upload artifact"
+ uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
+ with:
+ name: SARIF file
+ path: results.sarif
+ retention-days: 5
+
+ # Upload the results to GitHub's code scanning dashboard (optional).
+ # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+ - name: "Upload to code-scanning"
+ uses: github/codeql-action/upload-sarif@v3
+ with:
+ sarif_file: results.sarif
From f701edc25db154ddeeadfdc3a3e5a797fb2fe54c Mon Sep 17 00:00:00 2001
From: John Bohannon <imjohnbo@kit.com>
Date: Thu, 14 Nov 2024 12:53:54 -0600
Subject: [PATCH 2/4] update runner image from 20.04 to 22.04
---
.github/workflows/ci.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e91eda2..7c5d938 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,7 +5,7 @@ on: [pull_request]
jobs:
ci:
- runs-on: ubuntu-20.04
+ runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v2
with:
From a96ab7fd3920c0ad56893f68ec4aa98d8314a448 Mon Sep 17 00:00:00 2001
From: John Bohannon <imjohnbo@kit.com>
Date: Thu, 14 Nov 2024 12:54:20 -0600
Subject: [PATCH 3/4] apply recommendations to ci.yaml from OSSF scorecard
workflow
---
.github/workflows/ci.yml | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7c5d938..0f41f34 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,22 +3,25 @@ name: ci
on: [pull_request]
+permissions:
+ contents: read
+
jobs:
ci:
runs-on: ubuntu-22.04
steps:
- - uses: actions/checkout@v2
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.4.2
with:
path: guides
- - uses: actions/checkout@v2
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.4.2
with:
repository: rubygems/rubygems
path: rubygems
ref: 3.5
- name: Set up Ruby
- uses: ruby/setup-ruby@v1
+ uses: ruby/setup-ruby@a2bbe5b1b236842c1cb7dd11e8e3b51e0a616acc #v1.202.0
with:
ruby-version: 3.2.2
bundler-cache: true
From ac2fc7a005b33061d9c5a2fe316c65d13932d409 Mon Sep 17 00:00:00 2001
From: John Bohannon <imjohnbo@kit.com>
Date: Thu, 14 Nov 2024 12:59:43 -0600
Subject: [PATCH 4/4] apply recommendations to scorecard.yaml from OSSF
scorecard workflow
---
.github/workflows/scorecard.yml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 3a9bb95..bcfd8a8 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -48,7 +48,7 @@ jobs:
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
# format to the repository Actions tab.
- name: "Upload artifact"
- uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
+ uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: SARIF file
path: results.sarif
@@ -57,6 +57,6 @@ jobs:
# Upload the results to GitHub's code scanning dashboard (optional).
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
- name: "Upload to code-scanning"
- uses: github/codeql-action/upload-sarif@v3
+ uses: github/codeql-action/upload-sarif@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f # v3.27.4
with:
sarif_file: results.sarif