chore(security): land OSS-CLI stack + wire OpenSSF Best Practices project (RAN-52)#94
Closed
aksOps wants to merge 1 commit into
Closed
chore(security): land OSS-CLI stack + wire OpenSSF Best Practices project (RAN-52)#94aksOps wants to merge 1 commit into
aksOps wants to merge 1 commit into
Conversation
…ject (RAN-52) - Add `.github/workflows/security.yml`: Semgrep, OSV-Scanner, Trivy fs, Gitleaks (Docker image, no license dep), jscpd, anchore/sbom-action. All actions SHA-pinned; SARIF → code scanning where supported, raw reports → workflow artifacts. Triggers: push/PR/weekly cron/dispatch. Subsumes the previously planned `osv-scanner.yml` (RAN-42). - Wire `.bestpractices.json` to project_id 12650 (registration unblocked between RAN-46 and RAN-52). - Replace the placeholder OpenSSF Best Practices README badge with the live `bestpractices.dev/projects/12650/badge`. - Document Scorecard baseline + target and the OSS-CLI stack in `CLAUDE.md` (new "Supply-chain observability (OpenSSF)" section). - Update `engineering-standards.md` §1 to reflect that OSV-Scanner has landed inside `security.yml`, and add a §5 row pointing at it. Auth-blocked items deferred to the board (called out in the PR body): final flip of the bestpractices.dev page from `in_progress` → `passing` and verification that signed-commit branch protection is enforced on `main`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-Authored-By: Paperclip <noreply@paperclip.ing>
Contributor
Author
|
Closing as superseded. While this PR was in flight, #91 (
This PR's design conflicts with that ruling on three points:
The only piece without overlap is the CLAUDE.md `Supply-chain observability (OpenSSF)` section (RAN-52 AC #7 — main's CLAUDE.md has zero OpenSSF mentions). I'll re-open that piece as a much smaller PR rebased on the post-#91 / #92 main, with prose aligned to the path-B ruling. No code from this PR is being merged. |
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes most of RAN-52 — the leftover-criteria + observability pass on top of RAN-46. Two acceptance items remain board-owned and are flagged at the bottom.
.github/workflows/security.yml(new) — consolidated (B) OSS-CLI security stack: Semgrep (SAST), OSV-Scanner (deps; second-source CVE feed cross-checking the existing OWASP Dependency-Check fromci-java.yml), Trivy (filesystem CVEs + IaC misconfig), Gitleaks (secret scan, run via the upstream Docker image to avoid the orgGITLEAKS_LICENSErequirement), jscpd (copy-paste detection), and anchore/sbom-action (SPDX SBOM). Triggers: push tomain, PR, weekly cron (Mon 06:00 UTC, same window asscorecard.yml),workflow_dispatch. Every job hardens egress withstep-security/harden-runnerand uploads SARIF to GitHub code scanning where supported plus raw reports as workflow artifacts. All actions SHA-pinned (ScorecardPinned-Dependencies)..bestpractices.json— registration unblocked between RAN-46 and RAN-52, soproject_idis now wired to12650and the registration-blocker note is cleared.README.md— replace the placeholder "pending registration" Best Practices badge with the livebestpractices.dev/projects/12650/badge(verified live via HTTP 200).CLAUDE.md— new "Supply-chain observability (OpenSSF)" section documenting the Best Practices project, the Scorecard baseline + target (≥ 8.0/10 stretch), known floor reductions (WebhooksN/A,Signed-Releasespartial), and the OSS-CLI stack pointer. Satisfies AC Remove Thymeleaf UI — consolidate to React SPA #7.shared/runbooks/engineering-standards.md— §1 paragraph rewritten so the OSV row is no longer "planned, RAN-42" (it has landed insidesecurity.yml); §5 gets a row pointing atsecurity.ymland the new CLAUDE.md section.Subsumes the previously planned standalone RAN-42
osv-scanner.yml. The OSS-CLI stack is observability-only at the bootstrap window — promotion to gate-blocking happens once a clean baseline exists.RAN-52 acceptance status
passingin_progress; repo-side criteria all evidenced via.bestpractices.json.github/workflows/scorecard.ymllands.github/workflows/security.ymlmirroring (B) OSS-CLI stackSECURITY.md+ signed-commit branch protection onmainSECURITY.mdalready in repo;README.md.bestpractices.jsonat repo rootCLAUDE.mdAuth-blocked items for the board
in_progresstopassingonce the maintainer reviews the answers there. Repo-side evidence is in place.main— engineering-standards §1 says the rule is enforced; needs a one-timegh api repos/RandomCodeSpace/codeiq/branches/main/protectionconfirmation thatrequired_signatures.enabled = true. If anything is missing, please add it.Test plan
chore/ran-52-best-practices-passing(existingci-java.yml+ the newsecurity.yml)security.ymlweekly cron fires Mondays 06:00 UTCsecurity.ymljobs upload either SARIF (Semgrep / OSV / Trivy) or artifacts (Gitleaks / jscpd / SBOM)bestpractices.dev/projects/12650/badge→ HTTP 200, verified)ci-java.yml,scorecard.yml,beta-java.yml,release-java.yml—actionlintclean on all five workflows🤖 Generated with Claude Code