Skip to content

Commit 5481122

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
committed
Add OpenSSF compliance workflows for showcase repo
Adds scorecard, CodeQL, quality, secret-scanner, and scorecard-enforcer workflows to bring OpenSSF audit score to 6/6. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent c362669 commit 5481122

6 files changed

Lines changed: 265 additions & 0 deletions

File tree

‎.github/workflows/codeql.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: CodeQL Security Analysis
3+
4+
on:
5+
push:
6+
branches: [main, master]
7+
pull_request:
8+
branches: [main, master]
9+
schedule:
10+
- cron: '0 6 * * 1'
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
analyze:
17+
runs-on: ubuntu-latest
18+
permissions:
19+
contents: read
20+
security-events: write
21+
strategy:
22+
fail-fast: false
23+
matrix:
24+
include:
25+
- language: actions
26+
build-mode: none
27+
28+
steps:
29+
- name: Checkout
30+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
31+
32+
- name: Initialize CodeQL
33+
uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.31.8
34+
with:
35+
languages: ${{ matrix.language }}
36+
build-mode: ${{ matrix.build-mode }}
37+
38+
- name: Perform CodeQL Analysis
39+
uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.31.8
40+
with:
41+
category: "/language:${{ matrix.language }}"

‎.github/workflows/quality.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: Code Quality
3+
on: [push, pull_request]
4+
5+
permissions:
6+
contents: read
7+
8+
jobs:
9+
lint:
10+
runs-on: ubuntu-latest
11+
permissions:
12+
contents: read
13+
steps:
14+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
15+
16+
- name: Check for secrets
17+
uses: trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d # v3.93.3
18+
with:
19+
path: ./
20+
base: ${{ github.event.pull_request.base.sha || github.event.before }}
21+
head: ${{ github.sha }}
22+
continue-on-error: true
23+
24+
- name: Check for large files
25+
run: |
26+
find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files"
27+
28+
- name: EditorConfig check
29+
uses: editorconfig-checker/action-editorconfig-checker@4b6cd6190d435e7e084fb35e36a096e98506f7b9 # v2.1.0
30+
continue-on-error: true
31+
32+
docs:
33+
runs-on: ubuntu-latest
34+
permissions:
35+
contents: read
36+
steps:
37+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
38+
- name: Check documentation
39+
run: |
40+
MISSING=""
41+
[ ! -f "README.md" ] && [ ! -f "README.adoc" ] && MISSING="$MISSING README"
42+
[ ! -f "LICENSE" ] && [ ! -f "LICENSE.txt" ] && [ ! -f "LICENSE.md" ] && MISSING="$MISSING LICENSE"
43+
[ ! -f "CONTRIBUTING.md" ] && [ ! -f "CONTRIBUTING.adoc" ] && MISSING="$MISSING CONTRIBUTING"
44+
45+
if [ -n "$MISSING" ]; then
46+
echo "::warning::Missing docs:$MISSING"
47+
else
48+
echo "Core documentation present"
49+
fi

‎.github/workflows/scorecard-enforcer.yml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: OpenSSF Scorecard Enforcer
3+
4+
on:
5+
push:
6+
branches: [main]
7+
schedule:
8+
- cron: '0 6 * * 1'
9+
workflow_dispatch:
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
scorecard:
16+
runs-on: ubuntu-latest
17+
permissions:
18+
security-events: write
19+
id-token: write
20+
steps:
21+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
persist-credentials: false
24+
25+
- name: Run Scorecard
26+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
27+
with:
28+
results_file: results.sarif
29+
results_format: sarif
30+
publish_results: true
31+
32+
- name: Upload SARIF
33+
uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.31.8
34+
with:
35+
sarif_file: results.sarif
36+
37+
check-critical:
38+
runs-on: ubuntu-latest
39+
steps:
40+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
41+
42+
- name: Check SECURITY.md exists
43+
run: |
44+
if [ ! -f "SECURITY.md" ]; then
45+
echo "::error::SECURITY.md is required"
46+
exit 1
47+
fi
48+
49+
- name: Check LICENSE exists
50+
run: |
51+
if [ ! -f "LICENSE" ] && [ ! -f "LICENSE.txt" ] && [ ! -f "LICENSE.md" ]; then
52+
echo "::error::LICENSE file is required"
53+
exit 1
54+
fi
55+
56+
- name: Check CONTRIBUTING exists
57+
run: |
58+
if [ ! -f "CONTRIBUTING.md" ] && [ ! -f "CONTRIBUTING.adoc" ]; then
59+
echo "::error::CONTRIBUTING file is required"
60+
exit 1
61+
fi
62+
63+
- name: Check for pinned dependencies
64+
run: |
65+
unpinned=$(grep -r "uses:.*@v[0-9]" .github/workflows/*.yml 2>/dev/null | grep -v "#" | head -5 || true)
66+
if [ -n "$unpinned" ]; then
67+
echo "::error::Found unpinned actions:"
68+
echo "$unpinned"
69+
exit 1
70+
fi

‎.github/workflows/scorecard.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: OSSF Scorecard
3+
on:
4+
push:
5+
branches: [main, master]
6+
schedule:
7+
- cron: '0 4 * * *'
8+
workflow_dispatch:
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
analysis:
15+
runs-on: ubuntu-latest
16+
permissions:
17+
security-events: write
18+
id-token: write
19+
steps:
20+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
21+
with:
22+
persist-credentials: false
23+
24+
- name: Run Scorecard
25+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
26+
with:
27+
results_file: results.sarif
28+
results_format: sarif
29+
30+
- name: Upload results
31+
uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.31.8
32+
with:
33+
sarif_file: results.sarif

‎.github/workflows/secret-scanner.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: Secret Scanner
3+
4+
on:
5+
pull_request:
6+
push:
7+
branches: [main]
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
trufflehog:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
17+
with:
18+
fetch-depth: 0
19+
20+
- name: TruffleHog Secret Scan
21+
uses: trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d # v3
22+
with:
23+
extra_args: --only-verified --fail
24+
25+
gitleaks:
26+
runs-on: ubuntu-latest
27+
steps:
28+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
29+
with:
30+
fetch-depth: 0
31+
32+
- name: Gitleaks Secret Scan
33+
uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
34+
env:
35+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/security-policy.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: Security Policy
3+
on: [push, pull_request]
4+
5+
permissions:
6+
contents: read
7+
8+
jobs:
9+
check:
10+
runs-on: ubuntu-latest
11+
permissions:
12+
contents: read
13+
steps:
14+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
15+
- name: Security checks
16+
run: |
17+
FAILED=false
18+
19+
# Block MD5/SHA1 for security (allow for checksums/caching)
20+
WEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)
21+
if [ -n "$WEAK_CRYPTO" ]; then
22+
echo "Warning: Weak crypto (MD5/SHA1) detected:"
23+
echo "$WEAK_CRYPTO"
24+
fi
25+
26+
# Block hardcoded secrets patterns
27+
SECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["'"'][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)
28+
if [ -n "$SECRETS" ]; then
29+
echo "Potential hardcoded secrets detected!"
30+
FAILED=true
31+
fi
32+
33+
if [ "$FAILED" = true ]; then
34+
exit 1
35+
fi
36+
37+
echo "Security policy check passed"

0 commit comments

Comments
 (0)