Skip to content

Commit 88efe0b

Browse files
erikgberikgb
committed
Add OSSF Scorecard workflow to gh-workflows module
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
1 parent 80a790b commit 88efe0b

4 files changed

Lines changed: 125 additions & 0 deletions

File tree

‎.github/workflows/scorecards.yaml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT.
2+
# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/gh-workflows/base/.github/workflows/scorecards.yaml instead.
3+
4+
name: Scorecards supply-chain security
5+
on:
6+
# Only the default branch is supported.
7+
branch_protection_rule:
8+
push:
9+
# We don't have a consistent name on our default branches, so include both variants for now.
10+
branches: ["main", "master"]
11+
12+
# Declare default permissions as read only.
13+
permissions: read-all
14+
15+
jobs:
16+
analysis:
17+
name: Scorecards analysis
18+
runs-on: ubuntu-latest
19+
if: github.repository_owner == 'cert-manager' && github.ref_name == github.event.repository.default_branch
20+
permissions:
21+
# Needed to upload the results to code-scanning dashboard.
22+
security-events: write
23+
# Used to receive a badge.
24+
id-token: write
25+
26+
steps:
27+
- name: "Checkout code"
28+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
29+
with:
30+
persist-credentials: false
31+
32+
- name: "Run analysis"
33+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
34+
with:
35+
results_file: results.sarif
36+
results_format: sarif
37+
38+
# Publish the results for public repositories to enable scorecard badges. For more details, see
39+
# https://github.com/ossf/scorecard-action#publishing-results.
40+
# For private repositories, `publish_results` will automatically be set to `false`, regardless
41+
# of the value entered here.
42+
publish_results: true
43+
44+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
45+
# format to the repository Actions tab.
46+
- name: "Upload artifact"
47+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
48+
with:
49+
name: SARIF file
50+
path: results.sarif
51+
retention-days: 5
52+
53+
# Upload the results to GitHub's code scanning dashboard.
54+
- name: "Upload to code-scanning"
55+
uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
56+
with:
57+
sarif_file: results.sarif

‎modules/gh-workflows/01_mod.mk‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,13 @@ shared_verify_targets += verify-pinact
2525
## @category [shared] Generate/ Verify
2626
fix-pinact: | $(NEEDS_PINACT)
2727
$(PINACT) run --fix --verify-comment
28+
29+
generate_gh_workflows_base_dir := $(dir $(lastword $(MAKEFILE_LIST)))/base/
30+
31+
.PHONY: generate-gh-workflows
32+
## Generate base files in the repository
33+
## @category [shared] Generate/ Verify
34+
generate-gh-workflows:
35+
cp -r $(generate_gh_workflows_base_dir)/. ./
36+
37+
shared_generate_targets += generate-gh-workflows

‎modules/gh-workflows/base/.github/workflows/scorecards.yaml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT.
2+
# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/gh-workflows/base/.github/workflows/scorecards.yaml instead.
3+
4+
name: Scorecards supply-chain security
5+
on:
6+
# Only the default branch is supported.
7+
branch_protection_rule:
8+
push:
9+
# We don't have a consistent name on our default branches, so include both variants for now.
10+
branches: ["main", "master"]
11+
12+
# Declare default permissions as read only.
13+
permissions: read-all
14+
15+
jobs:
16+
analysis:
17+
name: Scorecards analysis
18+
runs-on: ubuntu-latest
19+
if: github.repository_owner == 'cert-manager' && github.ref_name == github.event.repository.default_branch
20+
permissions:
21+
# Needed to upload the results to code-scanning dashboard.
22+
security-events: write
23+
# Used to receive a badge.
24+
id-token: write
25+
26+
steps:
27+
- name: "Checkout code"
28+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
29+
with:
30+
persist-credentials: false
31+
32+
- name: "Run analysis"
33+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
34+
with:
35+
results_file: results.sarif
36+
results_format: sarif
37+
38+
# Publish the results for public repositories to enable scorecard badges. For more details, see
39+
# https://github.com/ossf/scorecard-action#publishing-results.
40+
# For private repositories, `publish_results` will automatically be set to `false`, regardless
41+
# of the value entered here.
42+
publish_results: true
43+
44+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
45+
# format to the repository Actions tab.
46+
- name: "Upload artifact"
47+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
48+
with:
49+
name: SARIF file
50+
path: results.sarif
51+
retention-days: 5
52+
53+
# Upload the results to GitHub's code scanning dashboard.
54+
- name: "Upload to code-scanning"
55+
uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
56+
with:
57+
sarif_file: results.sarif

‎renovate-config.json5‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,5 +56,6 @@
5656
// Exclude files that are sourced from makefile-modules and shouldn't be upgraded in projects using makefile-modules.
5757
'make/_shared/**',
5858
'.github/workflows/govulncheck.yaml',
59+
'.github/workflows/scorecards.yaml',
5960
],
6061
}

0 commit comments

Comments
 (0)