Skip to content

Commit fd1b3ce

Browse files
jmeridthjmeridth
authored
Merge pull request #267 from github/jm-ossf-scorecard
chore: add OSSF scorecard github action and README badge
2 parents ed65b33 + a8bf01d commit fd1b3ce

12 files changed

+72
-47
lines changed

‎.github/workflows/auto-labeler.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
name: Auto label pull requests
2222
runs-on: ubuntu-latest
2323
steps:
24-
- uses: release-drafter/release-drafter@v6
24+
- uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348
2525
env:
2626
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2727
with:

‎.github/workflows/codeql-analysis.yml

Lines changed: 4 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -34,39 +34,14 @@ jobs:
3434
fail-fast: false
3535
matrix:
3636
language: [ 'python' ]
37-
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
38-
# Learn more:
39-
# https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
40-
4137
steps:
4238
- name: Checkout repository
43-
uses: actions/checkout@v4
44-
45-
# Initializes the CodeQL tools for scanning.
39+
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
4640
- name: Initialize CodeQL
47-
uses: github/codeql-action/init@v3
41+
uses: github/codeql-action/init@d39d31e687223d841ef683f52467bd88e9b21c14
4842
with:
4943
languages: ${{ matrix.language }}
50-
# If you wish to specify custom queries, you can do so here or in a config file.
51-
# By default, queries listed here will override any specified in a config file.
52-
# Prefix the list here with "+" to use these queries and those in the config file.
53-
# queries: ./path/to/local/query, your-org/your-repo/queries@main
54-
55-
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
56-
# If this step fails, then you should remove it and run the build manually (see below)
5744
- name: Autobuild
58-
uses: github/codeql-action/autobuild@v3
59-
60-
# ℹ️ Command-line programs to run using the OS shell.
61-
# 📚 https://git.io/JvXDl
62-
63-
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
64-
# and modify them (or add more) to build your code if your project
65-
# uses a compiled language
66-
67-
#- run: |
68-
# make bootstrap
69-
# make release
70-
45+
uses: github/codeql-action/autobuild@d39d31e687223d841ef683f52467bd88e9b21c14
7146
- name: Perform CodeQL Analysis
72-
uses: github/codeql-action/analyze@v3
47+
uses: github/codeql-action/analyze@d39d31e687223d841ef683f52467bd88e9b21c14

‎.github/workflows/contributor_report.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
echo "END_DATE=$end_date" >> "$GITHUB_ENV"
2929
3030
- name: Run contributor action
31-
uses: github/contributors@v1
31+
uses: github/contributors@832b6518181710ef277bc9ddafda6696e6b312bd
3232
env:
3333
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3434
START_DATE: ${{ env.START_DATE }}
@@ -37,7 +37,7 @@ jobs:
3737
SPONSOR_INFO: "true"
3838

3939
- name: Create issue
40-
uses: peter-evans/create-issue-from-file@v5
40+
uses: peter-evans/create-issue-from-file@24452a72d85239eacf1468b0f1982a9f3fec4c94
4141
with:
4242
title: Monthly contributor report
4343
token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/docker-image.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,6 @@ jobs:
1414
build:
1515
runs-on: ubuntu-latest
1616
steps:
17-
- uses: actions/checkout@v4
17+
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
1818
- name: Build the Docker image
1919
run: docker build . --file Dockerfile --platform linux/amd64 --tag issue-metrics:"$(date +%s)"

‎.github/workflows/linter.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
statuses: write
1919
steps:
2020
- name: Checkout Code
21-
uses: actions/checkout@v4
21+
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
2222
with:
2323
# Full git history is needed to get a proper
2424
# list of changed files within `super-linter`
@@ -28,7 +28,7 @@ jobs:
2828
python -m pip install --upgrade pip
2929
pip install -r requirements.txt -r requirements-test.txt
3030
- name: Lint Code Base
31-
uses: super-linter/super-linter@v6
31+
uses: super-linter/super-linter@4758be622215d0954c8353ee4877ffd60111cf8e
3232
env:
3333
DEFAULT_BRANCH: main
3434
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/major-version-updater.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
contents: write
1616
steps:
1717
- name: Checkout Repo
18-
uses: actions/checkout@v4
18+
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
1919

2020
- name: version
2121
id: version

‎.github/workflows/pr-title.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
name: Validate PR title
2121
runs-on: ubuntu-latest
2222
steps:
23-
- uses: amannn/action-semantic-pull-request@v5
23+
- uses: amannn/action-semantic-pull-request@e9fabac35e210fea40ca5b14c0da95a099eff26f
2424
env:
2525
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2626
with:

‎.github/workflows/python-package.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ jobs:
2222
python-version: [3.11, 3.12]
2323

2424
steps:
25-
- uses: actions/checkout@v4
25+
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
2626
- name: Set up Python ${{ matrix.python-version }}
27-
uses: actions/setup-python@v5
27+
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d
2828
with:
2929
python-version: ${{ matrix.python-version }}
3030
- name: Install dependencies

‎.github/workflows/release.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333
contents: write
3434
pull-requests: read
3535
steps:
36-
- uses: release-drafter/release-drafter@v6
36+
- uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348
3737
id: release-drafter
3838
env:
3939
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -55,17 +55,17 @@
5555
IMAGE_NAME: github/issue_metrics # different than repo name (underscore instead of dash)
5656
steps:
5757
- name: Set up Docker Buildx
58-
uses: docker/setup-buildx-action@v3
58+
uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb
5959
- name: Log in to the Container registry
60-
uses: docker/login-action@v3
60+
uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20
6161
with:
6262
registry: ${{ env.REGISTRY }}
6363
username: ${{ github.actor }}
6464
password: ${{ secrets.GITHUB_TOKEN }}
65-
- uses: actions/checkout@v4
65+
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
6666
- name: Push Docker Image
6767
if: ${{ success() }}
68-
uses: docker/build-push-action@v5
68+
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0
6969
with:
7070
context: .
7171
file: ./Dockerfile
@@ -84,7 +84,7 @@
8484
discussions: write
8585
steps:
8686
- name: Create an announcement discussion for release
87-
uses: abirismyname/create-discussion@v1.2.0
87+
uses: abirismyname/create-discussion@6e6ef67e5eeb042343ef8b3d8d0f5d545cbdf024
8888
env:
8989
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
9090
with:

‎.github/workflows/scorecard.yml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
name: Scorecard supply-chain security
3+
on:
4+
workflow_dispatch:
5+
# For Branch-Protection check (for repo branch protection or rules).
6+
# Only the default branch is supported. See
7+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
8+
branch_protection_rule:
9+
# To guarantee Maintained check is occasionally updated. See
10+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
11+
schedule:
12+
- cron: '29 11 * * 6'
13+
push:
14+
branches: ["main"]
15+
16+
permissions: read-all
17+
18+
jobs:
19+
analysis:
20+
name: Merge to Main Scorecard analysis
21+
runs-on: ubuntu-latest
22+
permissions:
23+
security-events: write
24+
id-token: write
25+
26+
steps:
27+
- name: "Checkout code"
28+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
29+
with:
30+
persist-credentials: false
31+
32+
- name: "Run analysis"
33+
uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
34+
with:
35+
results_file: results.sarif
36+
results_format: sarif
37+
publish_results: true
38+
- name: "Upload artifact"
39+
uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
40+
with:
41+
name: SARIF file
42+
path: results.sarif
43+
retention-days: 5
44+
- name: "Upload to code-scanning"
45+
uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
46+
with:
47+
sarif_file: results.sarif

0 commit comments

Comments
 (0)