Skip to content

Commit 75854c6

Browse files
ppkarwaszppkarwasz
committed
feat: Add reusable scorecards-analysis-reusable.yml workflow
Similar to #699, adds a reusable Scorecard analysis workflow and refactors `scorecards-analysis.yml` to call it. Unlike the CodeQL workflow, which only relies on actions from GitHub-owned organisations (`github` and `actions`), this one uses a third-party action (`ossf/scorecard-action`) that needs to be upgraded in a timely manner. The usual process is: 1. A new version of the action is released. 2. The action is reviewed in `infrastructure-actions` and the new SHA is added to the authorized ones. 3. The old SHA is scheduled for removal. We need to perform the upgrade between steps 2 and 3, so we should configure Dependabot to bump this action weekly with a 7-day cooldown (step 2 occurs within 7 days of a new release).
1 parent ba250c3 commit 75854c6

3 files changed

Lines changed: 142 additions & 40 deletions

File tree

‎.github/workflows/README.md‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
<!---
2+
Licensed to the Apache Software Foundation (ASF) under one or more
3+
contributor license agreements. See the NOTICE file distributed with
4+
this work for additional information regarding copyright ownership.
5+
The ASF licenses this file to You under the Apache License, Version 2.0
6+
(the "License"); you may not use this file except in compliance with
7+
the License. You may obtain a copy of the License at
8+
9+
https://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
-->
17+
18+
# Reusable Workflows
19+
20+
This directory contains
21+
[reusable GitHub Actions workflows](https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows)
22+
shared across Apache Commons projects. They provide a consistent and secure CI setup without duplicating configuration in each repository.
23+
24+
## Scorecards (`scorecards-analysis-reusable.yml`)
25+
26+
Runs an [OpenSSF Scorecard](https://securityscorecards.dev/) analysis and uploads the results to
27+
GitHub's code-scanning dashboard.
28+
For public repositories, the results are also published to the Scorecard API, enabling the
29+
Scorecard badge.
30+
31+
This workflow has no inputs.
32+
33+
### Required permissions
34+
35+
In addition to uploading results to the code-scanning dashboard (`security-events: write`),
36+
the workflow authenticates with securityscorecards.dev using an OIDC token (`id-token: write`).
37+
The caller job must grant:
38+
39+
```yaml
40+
permissions:
41+
actions: read
42+
contents: read
43+
security-events: write
44+
id-token: write
45+
```
46+
47+
### Usage example
48+
49+
```yaml
50+
name: Scorecards
51+
52+
on:
53+
branch_protection_rule:
54+
schedule:
55+
- cron: '30 1 * * 6' # Randomize this expression
56+
push:
57+
branches: [ "master" ]
58+
59+
# Explicitly drop all permissions for security.
60+
permissions: { }
61+
62+
jobs:
63+
scorecards:
64+
# Intentionally not pinned: maintained by the same PMC.
65+
uses: apache/commons-parent/.github/workflows/scorecards-analysis-reusable.yml@master
66+
permissions:
67+
actions: read
68+
contents: read
69+
security-events: write
70+
id-token: write
71+
```

‎.github/workflows/scorecards-analysis-reusable.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one or more
2+
# contributor license agreements. See the NOTICE file distributed with
3+
# this work for additional information regarding copyright ownership.
4+
# The ASF licenses this file to You under the Apache license, Version 2.0
5+
# (the "License"); you may not use this file except in compliance with
6+
# the License. You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the license for the specific language governing permissions and
14+
# limitations under the license.
15+
16+
name: Scorecards
17+
18+
on:
19+
workflow_call: { }
20+
21+
# Explicitly drop all permissions inherited from the caller for security.
22+
permissions: { }
23+
24+
jobs:
25+
26+
scorecards-analysis:
27+
runs-on: ubuntu-latest
28+
permissions:
29+
actions: read
30+
contents: read
31+
# Needed to upload the results to the code-scanning dashboard.
32+
security-events: write
33+
# Needed to sign the results using Fulcio
34+
id-token: write
35+
36+
steps:
37+
38+
- name: "Checkout code"
39+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
40+
with:
41+
persist-credentials: false
42+
43+
- name: "Run analysis"
44+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # 2.4.3
45+
with:
46+
results_file: results.sarif
47+
results_format: sarif
48+
repo_token: ${{ github.token }}
49+
# Publish the results for public repositories to enable scorecard badges.
50+
publish_results: true
51+
52+
- name: "Upload artifact"
53+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
54+
with:
55+
name: SARIF file
56+
path: results.sarif
57+
retention-days: 5
58+
59+
- name: "Upload to code-scanning"
60+
uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
61+
with:
62+
sarif_file: results.sarif

‎.github/workflows/scorecards-analysis.yml‎

Lines changed: 9 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -21,49 +21,18 @@ on:
2121
- cron: "30 1 * * 6" # Weekly on Saturdays
2222
push:
2323
branches: [ "master" ]
24+
# For testing purposes
25+
workflow_dispatch: { }
2426

25-
permissions: read-all
27+
# Explicitly drop all permissions for security.
28+
permissions: { }
2629

2730
jobs:
2831

29-
analysis:
30-
31-
name: "Scorecards analysis"
32-
runs-on: ubuntu-latest
32+
scorecards-analysis:
33+
uses: ./.github/workflows/scorecards-analysis-reusable.yml
3334
permissions:
34-
# Needed to upload the results to the code-scanning dashboard.
35-
security-events: write
3635
actions: read
37-
id-token: write # This is required for requesting the JWT
38-
contents: read # This is required for actions/checkout
39-
40-
steps:
41-
42-
- name: "Checkout code"
43-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
44-
with:
45-
persist-credentials: false
46-
47-
- name: "Run analysis"
48-
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # 2.4.3
49-
with:
50-
results_file: results.sarif
51-
results_format: sarif
52-
# A read-only PAT token, which is sufficient for the action to function.
53-
# The relevant discussion: https://github.com/ossf/scorecard-action/issues/188
54-
repo_token: ${{ secrets.GITHUB_TOKEN }}
55-
# Publish the results for public repositories to enable scorecard badges.
56-
# For more details: https://github.com/ossf/scorecard-action#publishing-results
57-
publish_results: true
58-
59-
- name: "Upload artifact"
60-
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
61-
with:
62-
name: SARIF file
63-
path: results.sarif
64-
retention-days: 5
65-
66-
- name: "Upload to code-scanning"
67-
uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
68-
with:
69-
sarif_file: results.sarif
36+
contents: read
37+
security-events: write
38+
id-token: write

0 commit comments

Comments
 (0)