👷 support for OpenSSF Scorecard #23
Conversation
|
Caution Review failedThe pull request is closed. WalkthroughA new GitHub Actions workflow file named Changes
Possibly related PRs
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Outside diff range and nitpick comments (2)
.github/workflows/scorecard.yml (2)
12-14: Consider adjusting the cron schedule for better coverageThe current schedule (Tuesday at 17:45 UTC) seems arbitrary. Consider scheduling it during your team's working hours for quicker response to findings, or during off-hours to minimize CI resource contention.
- - cron: '45 17 * * 2' + - cron: '0 0 * * 1' # Run at midnight UTC on Mondays
23-23: Pin the Ubuntu runner version for stabilityUsing
ubuntu-latestmay lead to unexpected behavior when GitHub updates the runner image. Consider pinning to a specific version.- runs-on: ubuntu-latest + runs-on: ubuntu-22.04
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (1)
.github/workflows/scorecard.yml(1 hunks)
🔇 Additional comments (2)
.github/workflows/scorecard.yml (2)
34-38: LGTM! Good security practices in place.
Excellent use of SHA pinning for the checkout action and proper credential handling with persist-credentials: false.
39-58: Verify Branch-Protection check functionality
The Branch-Protection check may not work as expected without the SCORECARD_TOKEN. Consider uncommenting and configuring the token if you want to enable this check.
| - name: "Upload to code-scanning" | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: results.sarif |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Pin CodeQL action to specific SHA
The CodeQL action is using a major version tag (@V3) which could lead to unexpected changes. Consider pinning to a specific SHA for better security and stability.
- uses: github/codeql-action/upload-sarif@v3
+ uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: "Upload to code-scanning" | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: results.sarif | |
| - name: "Upload to code-scanning" | |
| uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4 | |
| with: | |
| sarif_file: results.sarif |
| - name: "Upload artifact" | ||
| uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20 | ||
| with: | ||
| name: SARIF file | ||
| path: results.sarif | ||
| retention-days: 5 | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Avoid pre-release versions for stability
The upload-artifact action is using a pre-release version (v3.pre.node20). Consider using the latest stable version.
- uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
+ uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: "Upload artifact" | |
| uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20 | |
| with: | |
| name: SARIF file | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: "Upload artifact" | |
| uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0 | |
| with: | |
| name: SARIF file | |
| path: results.sarif | |
| retention-days: 5 |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #23 +/- ##
=======================================
Coverage 85.58% 85.58%
=======================================
Files 31 31
Lines 680 680
Branches 84 84
=======================================
Hits 582 582
Misses 95 95
Partials 3 3 ☔ View full report in Codecov by Sentry. |
|
This pull request introduces a new GitHub Actions workflow to enhance the security of the supply chain using Scorecard. The workflow is designed to run on a schedule and on pushes to the main branch, performing security analysis and uploading results.
New GitHub Actions workflow for supply chain security:
.github/workflows/scorecard.yml: Added a new workflow named "Scorecard supply-chain security" that runs Scorecard analysis on the main branch and on a scheduled basis. The workflow includes steps for checking out the code, running the analysis, and uploading the results as artifacts and to GitHub's code scanning dashboard.Summary by CodeRabbit
New Features
Chores