From da4ae0e498987663b7db95ad1cdd3866bf5a2652 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Tue, 10 Oct 2023 13:06:30 +0200 Subject: [PATCH] ci: use reusable Scorecard workflow (#241) --- .github/workflows/ci.yaml | 1 + .github/workflows/codeql.yaml | 2 + .github/workflows/dependency-review.yaml | 14 +---- .github/workflows/lint-pr.yaml | 2 + .github/workflows/release-please.yaml | 2 + .github/workflows/scorecard.yaml | 20 +++++++ .github/workflows/scorecards.yaml | 72 ------------------------ 7 files changed, 30 insertions(+), 83 deletions(-) create mode 100644 .github/workflows/scorecard.yaml delete mode 100644 .github/workflows/scorecards.yaml diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 3e2eac1..c5ddafe 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -8,6 +8,7 @@ on: concurrency: group: ci-${{ github.head_ref || github.ref }} cancel-in-progress: true + permissions: contents: read jobs: diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index 18112df..389dd6d 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -10,6 +10,8 @@ on: schedule: - cron: "34 0 * * 3" +permissions: + contents: read jobs: trigger: uses: statnett/github-workflows/.github/workflows/codeql.yaml@main diff --git a/.github/workflows/dependency-review.yaml b/.github/workflows/dependency-review.yaml index 2c0c14a..bde5001 100644 --- a/.github/workflows/dependency-review.yaml +++ b/.github/workflows/dependency-review.yaml @@ -1,18 +1,10 @@ --- -# Dependency Review Action -# -# This Action will scan dependency manifest files that change as part of a Pull Request, -# surfacing known-vulnerable versions of the packages declared or updated in the PR. -# Once installed, if the workflow run is marked as required, -# PRs introducing known-vulnerable packages will be blocked from merging. -# -# Source repository: https://github.com/actions/dependency-review-action -name: 'Dependency Review' -on: [pull_request] +name: Dependency Review +on: + pull_request: permissions: contents: read - jobs: dependency-review: runs-on: ubuntu-latest diff --git a/.github/workflows/lint-pr.yaml b/.github/workflows/lint-pr.yaml index 4be350a..25e503b 100644 --- a/.github/workflows/lint-pr.yaml +++ b/.github/workflows/lint-pr.yaml @@ -7,6 +7,8 @@ on: - edited - synchronize +permissions: + contents: read jobs: trigger: uses: statnett/github-workflows/.github/workflows/lint-pr.yaml@main diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml index b7f342b..1b6e568 100644 --- a/.github/workflows/release-please.yaml +++ b/.github/workflows/release-please.yaml @@ -6,6 +6,8 @@ on: - main workflow_dispatch: +permissions: + contents: read jobs: trigger: uses: statnett/github-workflows/.github/workflows/release-please.yaml@main diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml new file mode 100644 index 0000000..9b99ada --- /dev/null +++ b/.github/workflows/scorecard.yaml @@ -0,0 +1,20 @@ +--- +name: Scorecard supply-chain security +on: + branch_protection_rule: + schedule: + - cron: '20 7 * * 2' + push: + branches: + - main + +permissions: + contents: read +jobs: + trigger: + uses: statnett/github-workflows/.github/workflows/scorecard.yaml@main + permissions: + security-events: write + id-token: write + contents: read + actions: read diff --git a/.github/workflows/scorecards.yaml b/.github/workflows/scorecards.yaml deleted file mode 100644 index c6fa195..0000000 --- a/.github/workflows/scorecards.yaml +++ /dev/null @@ -1,72 +0,0 @@ ---- -# This workflow uses actions that are not certified by GitHub. They are provided -# by a third-party and are governed by separate terms of service, privacy -# policy, and support documentation. - -name: Scorecard supply-chain security -on: - # For Branch-Protection check. Only the default branch is supported. See - # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection - branch_protection_rule: - # To guarantee Maintained check is occasionally updated. See - # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained - schedule: - - cron: '20 7 * * 2' - push: - branches: ["main"] - -permissions: - content: read - -jobs: - analysis: - name: Scorecard analysis - runs-on: ubuntu-latest - permissions: - # Needed to upload the results to code-scanning dashboard. - security-events: write - # Needed to publish results and get a badge (see publish_results below). - id-token: write - contents: read - actions: read - - steps: - - name: "Checkout code" - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - with: - persist-credentials: false - - - name: "Run analysis" - uses: ossf/scorecard-action@483ef80eb98fb506c348f7d62e28055e49fe2398 # v2.3.0 - with: - results_file: results.sarif - results_format: sarif - # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: - # - you want to enable the Branch-Protection check on a *public* repository, or - # - you are installing Scorecards on a *private* repository - # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. - # repo_token: ${{ secrets.SCORECARD_TOKEN }} - - # Public repositories: - # - Publish results to OpenSSF REST API for easy access by consumers - # - Allows the repository to include the Scorecard badge. - # - See https://github.com/ossf/scorecard-action#publishing-results. - # For private repositories: - # - `publish_results` will always be set to `false`, regardless - # of the value entered here. - publish_results: true - - # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF - # format to the repository Actions tab. - - name: "Upload artifact" - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 - with: - name: SARIF file - path: results.sarif - retention-days: 5 - - # Upload the results to GitHub's code scanning dashboard. - - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@fdcae64e1484d349b3366718cdfef3d404390e85 # v2.22.1 - with: - sarif_file: results.sarif