Skip to content

Commit 8e38ea1

Browse files
ppkarwaszppkarwasz
authored
feat: Add reusable scorecards-analysis-reusable.yml workflow (#700)
Similar to #699, adds a reusable Scorecard analysis workflow and refactors `scorecards-analysis.yml` to call it. Unlike the CodeQL workflow, which only relies on actions from GitHub-owned organisations (`github` and `actions`), this one uses a third-party action (`ossf/scorecard-action`) that needs to be upgraded in a timely manner. The usual process is: 1. A new version of the action is released. 2. The action is reviewed in `infrastructure-actions` and the new SHA is added to the authorized ones. 3. The old SHA is scheduled for removal. We need to perform the upgrade between steps 2 and 3, so we should configure Dependabot to bump this action weekly with a 7-day cooldown (step 2 occurs within 7 days of a new release).
1 parent 521ae62 commit 8e38ea1

3 files changed

Lines changed: 121 additions & 40 deletions

File tree

‎.github/workflows/README.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,3 +74,53 @@ jobs:
7474
contents: read
7575
security-events: write
7676
```
77+
78+
## Scorecards (`scorecards-analysis-reusable.yml`)
79+
80+
Runs an [OpenSSF Scorecard](https://securityscorecards.dev/) analysis and uploads the results to
81+
GitHub's code-scanning dashboard.
82+
For public repositories, the results are also published to the Scorecard API, enabling the
83+
Scorecard badge.
84+
85+
This workflow has no inputs.
86+
87+
### Required permissions
88+
89+
In addition to uploading results to the code-scanning dashboard (`security-events: write`),
90+
the workflow authenticates with securityscorecards.dev using an OIDC token (`id-token: write`).
91+
The caller job must grant:
92+
93+
```yaml
94+
permissions:
95+
actions: read
96+
contents: read
97+
security-events: write
98+
id-token: write
99+
```
100+
101+
### Usage example
102+
103+
```yaml
104+
name: Scorecards
105+
106+
on:
107+
branch_protection_rule:
108+
schedule:
109+
- cron: '30 1 * * 6' # Randomize this expression
110+
push:
111+
branches: [ "master" ]
112+
113+
# Explicitly drop all permissions for security.
114+
permissions: { }
115+
116+
jobs:
117+
scorecards:
118+
# Intentionally not pinned: maintained by the same PMC.
119+
uses: apache/commons-parent/.github/workflows/scorecards-analysis-reusable.yml@master
120+
permissions:
121+
actions: read
122+
contents: read
123+
security-events: write
124+
id-token: write
125+
```
126+

‎.github/workflows/scorecards-analysis-reusable.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one or more
2+
# contributor license agreements. See the NOTICE file distributed with
3+
# this work for additional information regarding copyright ownership.
4+
# The ASF licenses this file to You under the Apache license, Version 2.0
5+
# (the "License"); you may not use this file except in compliance with
6+
# the License. You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the license for the specific language governing permissions and
14+
# limitations under the license.
15+
16+
name: Scorecards
17+
18+
on:
19+
workflow_call: { }
20+
21+
# Explicitly drop all permissions inherited from the caller for security.
22+
permissions: { }
23+
24+
jobs:
25+
26+
scorecards-analysis:
27+
runs-on: ubuntu-latest
28+
permissions:
29+
actions: read
30+
contents: read
31+
# Needed to upload the results to the code-scanning dashboard.
32+
security-events: write
33+
# Needed to sign the results using Fulcio
34+
id-token: write
35+
36+
steps:
37+
38+
- name: "Checkout code"
39+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
40+
with:
41+
persist-credentials: false
42+
43+
- name: "Run analysis"
44+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # 2.4.3
45+
with:
46+
results_file: results.sarif
47+
results_format: sarif
48+
repo_token: ${{ github.token }}
49+
# Publish the results for public repositories to enable scorecard badges.
50+
publish_results: true
51+
52+
- name: "Upload artifact"
53+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
54+
with:
55+
name: SARIF file
56+
path: results.sarif
57+
retention-days: 5
58+
59+
- name: "Upload to code-scanning"
60+
uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
61+
with:
62+
sarif_file: results.sarif

‎.github/workflows/scorecards-analysis.yml‎

Lines changed: 9 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -21,49 +21,18 @@ on:
2121
- cron: "30 1 * * 6" # Weekly on Saturdays
2222
push:
2323
branches: [ "master" ]
24+
# For testing purposes
25+
workflow_dispatch: { }
2426

25-
permissions: read-all
27+
# Explicitly drop all permissions for security.
28+
permissions: { }
2629

2730
jobs:
2831

29-
analysis:
30-
31-
name: "Scorecards analysis"
32-
runs-on: ubuntu-latest
32+
scorecards-analysis:
33+
uses: ./.github/workflows/scorecards-analysis-reusable.yml
3334
permissions:
34-
# Needed to upload the results to the code-scanning dashboard.
35-
security-events: write
3635
actions: read
37-
id-token: write # This is required for requesting the JWT
38-
contents: read # This is required for actions/checkout
39-
40-
steps:
41-
42-
- name: "Checkout code"
43-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
44-
with:
45-
persist-credentials: false
46-
47-
- name: "Run analysis"
48-
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # 2.4.3
49-
with:
50-
results_file: results.sarif
51-
results_format: sarif
52-
# A read-only PAT token, which is sufficient for the action to function.
53-
# The relevant discussion: https://github.com/ossf/scorecard-action/issues/188
54-
repo_token: ${{ secrets.GITHUB_TOKEN }}
55-
# Publish the results for public repositories to enable scorecard badges.
56-
# For more details: https://github.com/ossf/scorecard-action#publishing-results
57-
publish_results: true
58-
59-
- name: "Upload artifact"
60-
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
61-
with:
62-
name: SARIF file
63-
path: results.sarif
64-
retention-days: 5
65-
66-
- name: "Upload to code-scanning"
67-
uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
68-
with:
69-
sarif_file: results.sarif
36+
contents: read
37+
security-events: write
38+
id-token: write

0 commit comments

Comments
 (0)