Skip to content

ci: add OpenSSF Scorecard analysis #1341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AdepuSriCharan wants to merge 3 commits into
base: main
Choose a base branch
from
+70 −0
Open

ci: add OpenSSF Scorecard analysis #1341

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
030caf7
ci: add OpenSSF Scorecard analysis
AdepuSriCharan Oct 22, 2026
54f5059
Merge branch 'main' into feat/openssf-scorecard
AdepuSriCharan Oct 24, 2026
ba9b1e7
ci: cancel superseded Scorecard runs
AdepuSriCharan Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 70 additions & 0 deletions .github/workflows/scorecard.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,70 @@
#
# Copyright 2026 The Dapr Authors
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# http://www.apache.org/licenses/LICENSE-2.0
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

name: OpenSSF Scorecard

on:
push:
branches:
- main
schedule:
- cron: '17 3 * * 3'
branch_protection_rule:
types: [created, edited, deleted]

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

permissions: read-all

@sicoyle sicoyle Oct 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: what do you think about adding a concurrency group here? If several pushes land on main close together, or a push lands near the weekly cron, each one kicks off a full Scorecard run that publishes results and uploads SARIF, but only the latest run actually matters. Something like this at the top level would drop the redundant runs:

concurrency:
 group: ${{ github.workflow }}-${{ github.ref }}
 cancel-in-progress: true

I'd use the block form rather than an inline { ... } mapping so the ${{ }} expression doesn't get tangled up with YAML flow syntax. Not blocking, happy to merge without it if you'd prefer to keep the workflow identical to the upstream template.

(

python-sdk/.github/workflows/scorecard.yaml

Line 26 in 54f5059

)

@AdepuSriCharan AdepuSriCharan Oct 27, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @sicoyle, good idea! I have added it in block form as you suggested. All three triggers run against main, so they share one group, and a newer run cancels the older one. The SARIF upload steps already skip cancelled runs. I also checked Scorecard's publish verifier, and it has no restriction on top-level concurrency, so publishing isn't affected.

jobs:
analysis:
name: Scorecard analysis
# Scorecard does not support forks.
if: github.repository == 'dapr/python-sdk'
runs-on: ubuntu-latest
timeout-minutes: 20
permissions:
contents: read
actions: read # Read workflow metadata for Scorecard checks.
security-events: write # Upload SARIF to code scanning.
id-token: write # Publish results using GitHub OIDC.
steps:
- name: Check out code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Run Scorecard analysis
uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
with:
results_file: results.sarif
results_format: sarif
publish_results: true

# Preserve generated results after a failure while respecting cancellation.
- name: Upload SARIF artifact
if: ${{ !cancelled() && hashFiles('results.sarif') != '' }}
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: scorecard-sarif
path: results.sarif
retention-days: 5

- name: Upload SARIF to code scanning
if: ${{ !cancelled() && hashFiles('results.sarif') != '' }}
uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
with:
sarif_file: results.sarif
category: ossf-scorecard
Loading