From 5aa2a0f68eb6835de62839a9caafbe627d285203 Mon Sep 17 00:00:00 2001 From: kkdev92 Date: Wed, 12 Aug 2026 23:59:46 +0900 Subject: [PATCH] ci: add the OpenSSF Scorecard workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every other check here tests the code. None of them look at how the code gets published — whether actions are pinned to SHAs, whether the default branch is protected, whether workflow tokens are scoped down, whether a vulnerability can be reported privately. Scorecard reads exactly that and scores it. It is worth having because most of those are *settings*, not code, so nothing in the existing lanes notices when one regresses. Results upload to the code scanning dashboard next to CodeQL, so a slip in the release pipeline surfaces in the same place as one in the source. Runs weekly, on pushes to `main`, and on demand. `permissions: read-all` at the top with the three writes it actually needs declared on the job. Both actions are pinned to commit SHAs, which is one of the things it grades. It reports and changes nothing. Free on public repositories. Co-Authored-By: Claude Opus 5 --- .github/workflows/scorecard.yml | 58 +++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..e9935bd --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,58 @@ +name: scorecard + +# OpenSSF Scorecard: an automated read of this repository's supply-chain posture — whether +# actions are pinned to SHAs, whether the default branch is protected, whether workflow tokens +# are scoped down, whether a vulnerability can be reported privately. +# +# It exists because every other check here tests the code, and none of them look at how the code +# gets published. Results land in the code scanning dashboard next to CodeQL, so a regression in +# the release pipeline shows up in the same place as one in the source. +# +# It reports; it changes nothing. Free on public repositories. + +on: + schedule: + # Weekly. Nothing here reacts to the clock, so the day is arbitrary — it just needs to be + # often enough that a settings change does not sit unmeasured for a month. + - cron: "0 7 * * 1" + # Branch protection and token permissions are settings rather than code, so a push that does + # not touch them can still move the score. The default branch is the only meaningful subject. + push: + branches: [main] + workflow_dispatch: + +permissions: read-all + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + analysis: + name: analyse + runs-on: ubuntu-latest + permissions: + # To upload the result to the code scanning dashboard. + security-events: write + # For the signed attestation Scorecard publishes about its own run. + id-token: write + contents: read + actions: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run analysis + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + with: + results_file: results.sarif + results_format: sarif + # Publishing makes the score readable by anyone deciding whether to depend on this, + # which is the point of measuring it. + publish_results: true + + - name: Upload to code scanning + uses: github/codeql-action/upload-sarif@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2 + with: + sarif_file: results.sarif