Skip to content

Add OSSF Scorecard workflow to gh-workflows module #651

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
erikgb wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add OSSF Scorecard workflow to gh-workflows module #651

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 57 additions & 0 deletions .github/workflows/scorecards.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT.
# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/gh-workflows/base/.github/workflows/scorecards.yaml instead.

name: Scorecards supply-chain security
on:
# Only the default branch is supported.
branch_protection_rule:
push:
# We don't have a consistent name on our default branches, so include both variants for now.
branches: ["main", "master"]

# Declare default permissions as read only.
permissions: read-all

jobs:
analysis:
name: Scorecards analysis
runs-on: ubuntu-latest
if: github.repository_owner == 'cert-manager' && github.ref_name == github.event.repository.default_branch
permissions:
# Needed to upload the results to code-scanning dashboard.
security-events: write
# Used to receive a badge.
id-token: write

steps:
- name: "Checkout code"
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false

- name: "Run analysis"
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
with:
results_file: results.sarif
results_format: sarif

# Publish the results for public repositories to enable scorecard badges. For more details, see
# https://github.com/ossf/scorecard-action#publishing-results.
# For private repositories, `publish_results` will automatically be set to `false`, regardless
# of the value entered here.
publish_results: true

# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
# format to the repository Actions tab.
- name: "Upload artifact"
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: SARIF file
path: results.sarif
retention-days: 5

# Upload the results to GitHub's code scanning dashboard.
- name: "Upload to code-scanning"
uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
with:
sarif_file: results.sarif
10 changes: 10 additions & 0 deletions modules/gh-workflows/01_mod.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,3 +25,13 @@ shared_verify_targets += verify-pinact
## @category [shared] Generate/ Verify
fix-pinact: | $(NEEDS_PINACT)
$(PINACT) run --fix --verify-comment

generate_gh_workflows_base_dir := $(dir $(lastword $(MAKEFILE_LIST)))/base/

@wallrj wallrj Aug 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: $(dir ...) already ends with /, so this expands to …/gh-workflows//base/ (and the recipe's $(var)/. adds another). Cosmetic, but it shows up in consumer logs; dropping the explicit / matches repository-base.


.PHONY: generate-gh-workflows
## Generate base files in the repository
## @category [shared] Generate/ Verify
generate-gh-workflows:

@wallrj wallrj Aug 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unlike the govulncheck equivalent, there's no opt-out: the go module wraps its target in ifndef dont_generate_govulncheck. Without one, an importer that doesn't want this workflow can't delete it — make verify regenerates the file and fails forever. Suggest an equivalent dont_generate_gh_workflows guard.

cp -r $(generate_gh_workflows_base_dir)/. ./
Comment thread
erikgb marked this conversation as resolved.

@wallrj wallrj Aug 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two things here:

  1. This is now the third copy of the copy-base-dir mechanism, after generate-base and generate-govulncheck; any fix (e.g. the opt-out above) has to land in three places. Given every project already imports repository-base, did you consider putting scorecards.yaml under modules/repository-base/base/.github/workflows/ instead? Zero new make code.
  2. The unconditional copy silently overwrites any pre-existing scorecards.yaml an importer maintains. That matches the existing generate-base behaviour, so probably fine — just noting it for the adoption PRs.


shared_generate_targets += generate-gh-workflows

@wallrj wallrj Aug 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Registering this in shared_generate_targets means a repo whose klone-bump PRs don't run make generate-klone && make generate (i.e. anything not using the shared Renovate preset's postUpgradeTasks) goes red on the bump PR: the module arrives but .github/workflows/scorecards.yaml doesn't exist yet, so the generate/verify diff fails until someone runs make generate locally. Worth a line in the adoption instructions.

57 changes: 57 additions & 0 deletions modules/gh-workflows/base/.github/workflows/scorecards.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT.
# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/gh-workflows/base/.github/workflows/scorecards.yaml instead.

name: Scorecards supply-chain security

@wallrj wallrj Aug 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On the cert-manager manual upgrade you mention in the description: until scorecards.yml is deleted there, both files will run on every push to master — duplicate SARIF uploads and duplicate scorecard publishes. Worth making the deletion part of the same adoption PR so there's no window with both.

on:
# Only the default branch is supported.
branch_protection_rule:
push:
# We don't have a consistent name on our default branches, so include both variants for now.
branches: ["main", "master"]

# Declare default permissions as read only.
permissions: read-all

jobs:
analysis:
name: Scorecards analysis
runs-on: ubuntu-latest
if: github.repository_owner == 'cert-manager' && github.ref_name == github.event.repository.default_branch

@erikgb erikgb Jul 7, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated description.

@wallrj wallrj Aug 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The govulncheck workflow templates the repository via {{REPLACE:GH-REPOSITORY}} + sed rather than hard-coding the org. With this hard-coded guard, a non-cert-manager importer (private jetstack repos, forks) gets a workflow that triggers on every push to main/master but always skips: permanent "skipped" noise it can't remove without failing make verify. Templating the repo name (or the opt-out suggested in 01_mod.mk) would cover that.

permissions:
# Needed to upload the results to code-scanning dashboard.
security-events: write
# Used to receive a badge.
id-token: write

steps:
- name: "Checkout code"
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false

- name: "Run analysis"
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
with:
results_file: results.sarif
results_format: sarif

# Publish the results for public repositories to enable scorecard badges. For more details, see
# https://github.com/ossf/scorecard-action#publishing-results.
# For private repositories, `publish_results` will automatically be set to `false`, regardless
# of the value entered here.
publish_results: true

# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
# format to the repository Actions tab.
- name: "Upload artifact"
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: SARIF file
path: results.sarif
retention-days: 5

# Upload the results to GitHub's code scanning dashboard.
- name: "Upload to code-scanning"
uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
with:
sarif_file: results.sarif

@wallrj wallrj Aug 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The owner guard still admits private repos inside the cert-manager org, should any adopt this module. There, publish_results auto-disables, but this SARIF upload needs code scanning, which private repos only have with GitHub Advanced Security — without it this step would fail on every push to the default branch. I haven't verified the exact codeql-action v4 behaviour, so treat as a plausible failure mode; continue-on-error: true on this step would be a cheap belt-and-braces fix.

1 change: 1 addition & 0 deletions renovate-config.json5
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,5 +56,6 @@
// Exclude files that are sourced from makefile-modules and shouldn't be upgraded in projects using makefile-modules.
'make/_shared/**',
'.github/workflows/govulncheck.yaml',
'.github/workflows/scorecards.yaml',

@wallrj wallrj Aug 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two edges to this exclusion, neither blocking:

  1. It only protects repos that extend this shared preset. An importer with its own Renovate config will get action-pin PRs against the generated file, which the generate/verify check then rejects — recurring churn until it adds its own ignorePaths entry.
  2. Conversely, a preset-consuming repo with a hand-written scorecards.yaml that hasn't adopted the module stops receiving pin bumps for it, so its action pins quietly go stale.

],
}
Loading