From 6e6cd1c9fdcaa9eb6e8728d976d69ecd72808c21 Mon Sep 17 00:00:00 2001 From: Pat Date: Wed, 2 Feb 2022 12:54:01 +0000 Subject: [PATCH] workflows: add scorecards analysis (#4721) Signed-off-by: Patrick Stephens --- .github/workflows/scorecards-analysis.yaml | 61 ++++++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 .github/workflows/scorecards-analysis.yaml diff --git a/.github/workflows/scorecards-analysis.yaml b/.github/workflows/scorecards-analysis.yaml new file mode 100644 index 00000000000..b05bf8c6a77 --- /dev/null +++ b/.github/workflows/scorecards-analysis.yaml @@ -0,0 +1,61 @@ + +--- +# https://openssf.org/blog/2022/01/19/reducing-security-risks-in-open-source-software-at-scale-scorecards-launches-v4/ +name: Scorecards supply-chain security +on: + # Only the default branch is supported. + branch_protection_rule: + schedule: + # Weekly on Saturdays. + - cron: '30 1 * * 6' + push: + branches: [ main, master ] + workflow_dispatch: + +# Declare default permissions as read only. +permissions: read-all + +jobs: + scorecard-analysis: + name: Scorecards analysis + runs-on: ubuntu-latest + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + actions: read + contents: read + + steps: + - name: "Checkout code" + uses: actions/checkout@v2 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@v1.0.2 + with: + results_file: results.sarif + results_format: sarif + # Read-only PAT token. To create it, + # follow the steps in https://github.com/ossf/scorecard-action#pat-token-creation. + repo_token: ${{ secrets.SCORECARD_READ_TOKEN }} + # Publish the results for public repositories to enable scorecard badges. For more details, see + # https://github.com/ossf/scorecard-action#publishing-results. + # For private repositories, `publish_results` will automatically be set to `false`, regardless + # of the value entered here. + publish_results: true + + # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF + # format to the repository Actions tab. + - name: "Upload artifact" + uses: actions/upload-artifact@v2 + with: + name: SARIF file + path: scorecard-results.sarif + retention-days: 7 + + # Upload the results to GitHub's code scanning dashboard. + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@v1.0.26 + with: + sarif_file: scorecard-results.sarif