Skip to content

Add OpenSSF Scorecards GitHub Action #48570

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
Sep 20, 2022
Merged

Add OpenSSF Scorecards GitHub Action #48570

Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
791691c
Create scorecards.yml
pnacht Sep 13, 2022
9dc12f5
Update scorecards.yml
pnacht Sep 14, 2022
ba27970
Add OpenSSF Scorecards badge to README.md
pnacht Sep 15, 2022
ad4c060
Merge branch 'pandas-dev:main' into main
pnacht Sep 15, 2022
4775ded
Trim whitespace in scorecards.yml
pnacht Sep 15, 2022
be63093
Merge branch 'main' into main
pnacht Sep 16, 2022
6e2aac8
Skip scorecards.yml on forks
pnacht Sep 16, 2022
6e304d6
Fix whitespace
pnacht Sep 16, 2022
fabc385
Pin scorecards.yml dependencies to major versions
pnacht Sep 19, 2022
9ba1518
Merge branch 'main' into main
pnacht Sep 20, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Trim whitespace in scorecards.yml
  • Loading branch information
@pnacht
pnacht authored Sep 15, 2022
commit 4775dedf6953ed62f2edbb1a1ea97ad1ecef9e6a
6 changes: 3 additions & 3 deletions .github/workflows/scorecards.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
security-events: write
# Used to receive a badge.
id-token: write

steps:
- name: "Checkout code"
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Curious, could we just specify the tags instead of the commit hashes here (that's what we do for other actions)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The OpenSSF recommends pinning to hashes instead of versions in order to protect against tag-renaming attacks (whereby an attacker hijacks an action, uploads a malicious version and replaces an existing tag with the malicious version). However, we're aware there are pros and cons to this approach, so if you prefer I can modify the workflow to use versions instead of hashes.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we would prefer using the tags for consistency with other workflows. We can look into using hashes for all of our workflows in the future.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

Expand All @@ -33,7 +33,7 @@ jobs:
results_format: sarif

# Publish the results for public repositories to enable scorecard badges. For more details, see
# https://github.com/ossf/scorecard-action#publishing-results.
# https://github.com/ossf/scorecard-action#publishing-results.
publish_results: true

# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
Expand All @@ -44,7 +44,7 @@ jobs:
name: SARIF file
path: results.sarif
retention-days: 5

# Upload the results to GitHub's code scanning dashboard.
- name: "Upload to code-scanning"
uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26
Expand Down