chore: add ossf action - #463
Conversation
SCC Complexity Analysis
|
…o v10 Removes the last unpatched brace-expansion/fast-uri/postcss chains (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-v2hh-gcrm-f6hx, GHSA-r28c-9q8g-f849) flagged by OSSF Scorecard. eslint 9's minimatch@3 chain was the only remaining unpinnable path to a vulnerable brace-expansion, so eslint/typescript-eslint/@eslint-js were bumped to their v10/v8.65 majors, which resolved on minimatch@10.
eslint 10's recommended config enables no-useless-assignment and preserve-caught-error. Fixes the two genuine dead-store bugs (cookies, config) and annotates the remaining cases where the flagged assignment or missing error cause is either intentional or needs a follow-up product decision rather than a behavior change here.
Adds SECURITY.md pointing reporters to GitHub Security Advisories (private vulnerability reporting is already enabled on this repo), addressing the OSSF Scorecard Security-Policy check.
Addresses the OSSF Scorecard Dependency-Update-Tool check by keeping the pnpm workspace and pinned GitHub Actions on a weekly update cadence.
…ermissions Pins every third-party and GitHub-owned action (checkout, setup-node, pnpm/action-setup, github-script, changesets/action, scc_check, osv-scanner-action) to a commit SHA, addressing the Pinned-Dependencies check. Replaces the ci.yml top-level write-all and the various job-level contents/pull-requests write grants with scoped read/write permissions per job, and adds explicit top-level permissions blocks where they were missing, addressing Token-Permissions. Also removes code-review.yml: its pull_request trigger was already commented out (workflow_dispatch only) and it was the one remaining unpinnable dependency (an ad-hoc npm install in a run step).
Addresses the OSSF Scorecard SAST check with a weekly and per-PR static analysis scan over the javascript-typescript codebase.
SCC Complexity Analysis
|
The advanced (workflow-based) CodeQL configuration conflicts with the repo's default code scanning setup: uploads fail with "CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled". Scorecard's SAST check detects CodeQL via the github-code-scanning app on recent merged PRs regardless of which setup produced it, so default setup alone keeps the check satisfied.
SCC Complexity Analysis
|
This reverts commit eec81f6. Scorecard's local SAST check (as run by our ossf-scorecard.yml workflow) only detects CodeQL by finding "github/codeql-action" in a workflow file; it does not reliably pick up default setup's check runs in that mode. Score dropped 8.6 -> 7.8 after removing this file. Restoring it alongside disabling the repo's default code scanning setup (required to avoid the "advanced configurations cannot be processed when the default setup is enabled" SARIF upload error).
SCC Complexity Analysis
|
A falha não está relacionada ao código em si. Ela acontece porque o CodeQL Default Setup está habilitado no repositório junto com o nosso workflow customizado (codeql.yml), e o GitHub não permite que ambos executem ao mesmo tempo. Não podemos simplesmente remover o workflow customizado, pois isso faz com que a nota do OSSF Scorecard diminua, já que ele deixa de reconhecer o check de SAST. A correção é desabilitar o CodeQL Default Setup e manter apenas o workflow customizado. Isso também explica por que o mesmo problema está acontecendo nos outros repositórios. |
Th3prof3ss0r
left a comment
Th3prof3ss0r
left a comment
There was a problem hiding this comment.
F01 🟡 MÉDIO — Override de proteção REMOVIDO: brace-expansion@5 · package.json:71-73
Este hunk remove o override "brace-expansion@5": ">=5.0.6" sem substituto para a linha 5.x, que continua na árvore (lockfile resolve brace-expansion@5.0.9). Essa linha tem 4 advisories abertos, o mais recente GHSA-rgw5-rvv9-x895 (high, corrigido em 5.0.9). Sugiro manter/reintroduzir "brace-expansion@5": ">=5.0.9", adicionar "brace-expansion@3": ">=3.0.6" e subir os novos pisos para "brace-expansion@1": ">=1.1.18" e "brace-expansion@2": ">=2.1.4" — os valores atuais (1.1.17 / 2.1.3) cobrem o GHSA-mh99 mas não o GHSA-rgw5.
F02 🟢 BAIXO — postcss e fast-uri com piso desatualizado · package.json:70,72
Mesmo ajuste do outro repo: postcss deveria ser >=8.5.23 (GHSA-fxqj-rqcc-2cmp) e fast-uri >=4.1.2 (GHSA-7p8r-x3mc-p8w7, publicado em 03/08). O lockfile já está nas versões corrigidas, é só alinhar o piso.
F03 🟢 BAIXO — scc_check fixado em SHA de branch, sem tag de release · scc-checker.yml:19
O pin de scc_check está correto (SHA confere com o HEAD de main), mas o comentário # main sugere um branch móvel e o repo não tem tags de release. Vale publicar uma tag em aziontech/scc_check e usar # vX.Y.Z como nos demais pins, para que futuras bumps sejam auditáveis contra uma versão e não contra "o main daquele dia".
5 participants
No description provided.