From 2396d08ee50eb6551b60ac3bfa155edd7731d71d Mon Sep 17 00:00:00 2001 From: Timur Tukaev Date: Sat, 23 May 2026 09:12:06 +0500 Subject: [PATCH] ci: add OpenSSF Scorecard workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Runs the OpenSSF Scorecard action on: - weekly schedule (Mon 06:00 UTC) - branch protection rule changes - pushes to main - manual dispatch Publishes results to: - the public OpenSSF Scorecard API (scorecard.dev) for transparency - the GitHub code-scanning dashboard (Security tab) for triage No README badge is added yet — the badge will be introduced in a follow-up PR once the first scans have run and any quick-win improvements (token permissions, dependency pinning) have landed. Aligns with the project's CNCF Incubation readiness work and the security self-assessment in progress. Signed-off-by: Timur Tukaev --- .github/workflows/scorecard.yml | 55 +++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 000000000..0bd3f7562 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,55 @@ +name: OpenSSF Scorecard + +on: + branch_protection_rule: + schedule: + # Run weekly on Mondays at 06:00 UTC. + - cron: '0 6 * * 1' + push: + branches: [main] + workflow_dispatch: + +# Declare default permissions as read-only. +permissions: read-all + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + permissions: + # Needed to upload the results to the GitHub code-scanning dashboard. + security-events: write + # Needed to publish results to the public scorecard.dev API + # (OIDC token allows publish without storing long-lived credentials). + id-token: write + # Needed to read repository contents. + contents: read + # Needed to read workflow definitions for the Dangerous-Workflow check. + actions: read + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + persist-credentials: false + + - name: Run analysis + uses: ossf/scorecard-action@v2 + with: + results_file: results.sarif + results_format: sarif + # Publish the results to the OpenSSF Scorecard public API so the + # project appears at https://scorecard.dev/viewer/?uri=github.com/cozystack/cozystack + publish_results: true + + - name: Upload SARIF as artifact + uses: actions/upload-artifact@v4 + with: + name: scorecard-sarif + path: results.sarif + retention-days: 5 + + - name: Upload SARIF to code-scanning + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: results.sarif