Skip to content

v1.12.0 — OpenSSF Silver badge & Scorecard improvements

Marketplace
Marketplace

Choose a tag to compare

View all tags
@Richonn Richonn released this 04 Apr 15:14
· 29 commits to main since this release
v1.12.0
This tag was signed with the committer’s verified signature.
Richonn Richonn
GPG key ID: 69DD7A8CACEA7A96
Verified
Learn about vigilant mode.
4879d60
This commit was signed with the committer’s verified signature.
Richonn Richonn
GPG key ID: 69DD7A8CACEA7A96
Verified
Learn about vigilant mode.

What's new

Governance and community files

Three new files establish the project's governance structure:

  • GOVERNANCE.md — documents the project roles, decision-making process, and continuity
    measures (MIT license, public registry artifacts, self-contained repo)
  • CODE_OF_CONDUCT.md — Contributor Covenant 2.1 adopted as the project code of conduct
  • DECISIONS.md expanded with an architecture overview (component structure, data flow,
    trust boundaries) and a formal assurance case (threat model, secure design principles,
    common CWEs countered)

DCO enforcement

All commits must now include a Signed-off-by line (git commit -s), asserting legal
authorization to contribute under the MIT license per the
Developer Certificate of Origin v1.1.

A new dco.yml reusable workflow checks for the sign-off on every push and PR,
called from ci.yml alongside the existing lint, test, and security jobs.

Cosign image signing

ShieldCI's own Docker image is now signed with
Cosign in keyless mode (GitHub OIDC) immediately
after each build. The signature is stored in the public Rekor transparency log.

This makes the Signed-Releases check in OpenSSF Scorecard detectable directly on the
registry, in addition to the existing SLSA Level 3 provenance.

Scorecard publishing

The scorecard.yml workflow now sets publish_results: true, sending results to the
public securityscorecards.dev API. The live Scorecard
badge in the README now reflects the current project score.

SBOM attached to GitHub Releases

The sbom.yml workflow now triggers on published releases in addition to pushes to main.
The Syft-generated SBOM is automatically attached as a downloadable asset to each GitHub
Release.

CI coverage reporting

test.yml now runs with -coverprofile and reports statement coverage for the core
packages (detect, generate) in the CI summary on every run.

Contributing documentation

CONTRIBUTING.md updated with:

  • DCO sign-off requirement and instructions
  • Explicit coding standards (gofmt, golangci-lint, Effective Go)
  • Developer quick setup section (go test, go build, act)
Assets 3
Loading