[WIP] policies: Add check for scorecard policies

[justaugustus]

Implements the scorecard Dependency Update Tool check as an Allstar policy.

Fixes/ #113

Signed-off-by: Stephen Augustus [email protected]

[justaugustus]

Heh, I copied the SECURITY.md policy and assumed this was a little simpler than it was (roughly a graphql query for some URL).

This actually more closely mimics the logic for branch protection.
We'll likely want to:

• get a repo
• get if automated alerts enabled
• get file .github/dependabot.yml

[jeffmendoza]

Looking good so far, let me know if you want an early review, or have any questions about anything.

[justaugustus]

Turns out scorecard already has a policy for this: https://github.com/ossf/scorecard/blob/main/docs/checks.md#dependency-update-tool
So this is roughly copy/paste of the Binary Artifacts policy logic and now ready for review 🤞🏾 :)

[jeffmendoza]

So this is roughly copy/paste of the Binary Artifacts policy logic

Oh ok, so I actually have a couple of issues with this unfortunately.

For Scorecard integration, the initial thought was #22 and that policy would list the names of the checks. A main driver is that we didn't want to be downloading the repo tarball multiple times in Allstar. Also, to share code.

However, with the scorecard action that launched, it looks like a better path is #28. This will essentially enforce all checks in scorecard.

I do still think we can and should have a dependabot/renovatebot policy in Allstar if we gain anything by having access to the GitHub API, which scorecard does not get.

[justaugustus]

FYI scorecard maintainers (@inferno-chromium @laurentsimon @naveensrinivasan @azeemshaikh38) --

I'm working on a refactor of the scorecard cmd to more easily allow consumers access to the same options that the CLI tool has. Once it's tighter, I'll lift it in the scorecard repo.

Opting to work in a temp directory in this PR because:

• I'm not positive of the final locations for various things
• It's cumbersome to do the changes, push to ✨ Miscellaneous refactors to ease downstream consumption scorecard#1645, then grab the new SHA here

[azeemshaikh38]

FYI scorecard maintainers (@inferno-chromium @laurentsimon @naveensrinivasan @azeemshaikh38) --

I'm working on a refactor of the scorecard cmd to more easily allow consumers access to the same options that the CLI tool has. Once it's tighter, I'll lift it in the scorecard repo.

Opting to work in a temp directory in this PR because:

• I'm not positive of the final locations for various things
• It's cumbersome to do the changes, push to ✨ [WIP] Miscellaneous refactors to ease downstream consumption scorecard#1645, then grab the new SHA here

I'm not sure I fully understand what this PR in AllStar is trying to achieve. Could you elaborate on:

• what's the goal in this PR
• how does it tie in with Feature: require GitHub Actions to be present #28 which seems is the long term plan for AllStar

[jeffmendoza]

Taking over in #240