Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Set up a SECURITY.md explaining how to confidentially report vulnerabilities. * Create scorecards.yml workflow to run OSSF scorecard to check supply chain security issues. * Use exact SHA's for actions versions to guard against hijacked actions repos that might try to substutite something else at the version tag we use. * Make sure actions we use don't get write perms on our repo. * Tried to use harden-runner action to ensure no actions on the runner overwrite source code or have unauthorized outgoing net connections during the GHA run, but currently leaving it disabled because of too many false positives -- it flags every dependency download as a case of altering source code. Which it technically is, but it doesn't matter for any jobs that aren't producing any artifacts that will be consumed or relied on by users. Signed-off-by: Larry Gritz <lg@larrygritz.com>
- Loading branch information
Showing
3 changed files
with
123 additions
and
11 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| name: Scorecards supply-chain security | ||
| on: | ||
| # Only the default branch is supported. | ||
| branch_protection_rule: | ||
| schedule: | ||
| - cron: '44 20 * * 6' | ||
| push: | ||
| branches: [ "main", "scorecard" ] | ||
|
|
||
| # Declare default permissions as read only. | ||
| permissions: read-all | ||
|
|
||
| jobs: | ||
| analysis: | ||
| name: Scorecards analysis | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| # Needed to upload the results to code-scanning dashboard. | ||
| security-events: write | ||
| # Used to receive a badge. (Upcoming feature) | ||
| id-token: write | ||
| # Needs for private repositories. | ||
| contents: read | ||
| actions: read | ||
|
|
||
| steps: | ||
| - name: "Checkout code" | ||
| uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # v3.0.0 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: "Run analysis" | ||
| uses: ossf/scorecard-action@3e15ea8318eee9b333819ec77a36aca8d39df13e # v1.1.1 | ||
| with: | ||
| results_file: results.sarif | ||
| results_format: sarif | ||
| # (Optional) Read-only PAT token. Uncomment the `repo_token` line below if: | ||
| # - you want to enable the Branch-Protection check on a *public* repository, or | ||
| # - you are installing Scorecards on a *private* repository | ||
| # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. | ||
| # repo_token: ${{ secrets.SCORECARD_READ_TOKEN }} | ||
|
|
||
| # Publish the results for public repositories to enable scorecard badges. For more details, see | ||
| # https://github.com/ossf/scorecard-action#publishing-results. | ||
| # For private repositories, `publish_results` will automatically be set to `false`, regardless | ||
| # of the value entered here. | ||
| publish_results: true | ||
|
|
||
| # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF | ||
| # format to the repository Actions tab. | ||
| - name: "Upload artifact" | ||
| uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v3.0.0 | ||
| with: | ||
| name: SARIF file | ||
| path: results.sarif | ||
| retention-days: 5 | ||
|
|
||
| # Upload the results to GitHub's code scanning dashboard. | ||
| - name: "Upload to code-scanning" | ||
| uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # v1.0.26 | ||
| with: | ||
| sarif_file: results.sarif |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| # Security Policy | ||
|
|
||
| ## Supported Versions | ||
|
|
||
| This gives guidance about which branches are supported with patches to | ||
| security vulnerabilities. | ||
|
|
||
| | Version / branch | Supported | | ||
| | --------- | ---------------------------------------------------- | | ||
| | main | :white_check_mark: :construction: ALL fixes immediately, but this is a branch under development with a frequently unstable ABI and occasionally unstable API. | | ||
| | 1.12.x | :white_check_mark: All fixes that can be backported without breaking ABI compatibility. New tagged releases monthly. | | ||
| | 1.11.x | :warning: Only the most critical fixes, only if they can be easily backported. | | ||
| | <= 1.10.x | :x: No longer receiving patches of any kind. | | ||
|
|
||
|
|
||
| ## Reporting a Vulnerability | ||
|
|
||
| If you think you've found a potential vulnerability in OSL, please report it | ||
| by emailing the project administrators at | ||
| [security@openshadinglanguage.org](security@openshadinglanguage.org). Only the | ||
| project administrators have access to these messages. Include detailed steps to | ||
| reproduce the issue, and any other information that could aid an | ||
| investigation. Our policy is to respond to vulnerability reports within 14 | ||
| days. | ||
|
|
||
| Our policy is to address critical security vulnerabilities rapidly and post | ||
| patches as quickly as possible. |