Security Scorecards integration

.github/dependabot.yml

@@ -23,5 +23,9 @@ updates:
     registries:
       - maven-snapshots
       - creek-github-packages
+    schedule:
+      interval: monthly
+  - package-ecosystem: docker
+    directory: /
     schedule:
       interval: monthly

.github/workflows/build.yml

@@ -15,24 +15,28 @@ on:
         description: "Publish snapshot artifacts: true or false?"
         default: "true"
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    permissions:
+      packages: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3.2.0
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+      - uses: gradle/wrapper-validation-action@55e685c48d84285a5b0418cd094606e199cca3b6 # v1.0.5
       - name: Fetch version history
         # Do NOT want to fetch all tags if building a specific tag.
         # Doing so could result in code published with wrong version, if newer tags have been pushed
         if: (!startsWith(github.ref, 'refs/tags/'))
         run: git fetch --tag --unshallow
       - name: Set up JDK
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@1df8dbefe2a8cbc99770194893dd902763bee34b # v3.9.0
         with:
           java-version: '16'
           distribution: 'adopt'
           cache: gradle
-      - name: Grant execute permission for gradlew
-        run: chmod +x gradlew
       - name: Build
         env:
           COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}
@@ -65,8 +69,8 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v3.2.0
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.0.0
       - name: Create GitHut Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
         with:
           generate_release_notes: true

.github/workflows/codeql.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
@@ -19,26 +22,23 @@ jobs:
         language: [ 'java' ]
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3.2.0
-
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: ${{ matrix.language }}
-
-    - name: Set up JDK
-      uses: actions/setup-java@v3
-      with:
-        java-version: '16'
-        distribution: 'adopt'
-        cache: gradle
-
-    - name: Grant execute permission for gradlew
-      run: chmod +x gradlew
-
-    - name: Build
-      run: ./gradlew test
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      - name: Checkout repository
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2.1.37
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Set up JDK
+        uses: actions/setup-java@1df8dbefe2a8cbc99770194893dd902763bee34b # v3.9.0
+        with:
+          java-version: '16'
+          distribution: 'adopt'
+          cache: gradle
+
+      - name: Build
+        run: ./gradlew test
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2.1.37

.github/workflows/release.yml

@@ -4,26 +4,27 @@ name: Release
 
 on: [workflow_dispatch]
 
+permissions:
+  contents: read
+
 concurrency: "${{ github.repository }}-versioning"
 
 jobs:
   release:
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v3.2.0
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
         with:
           token: ${{ secrets.TRIGGER_GITHUB_TOKEN }}
       - name: Fetch version history
         run: git fetch --tags --unshallow
       - name: Set up JDK
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@1df8dbefe2a8cbc99770194893dd902763bee34b # v3.9.0
         with:
           java-version: '16'
           distribution: 'adopt'
           cache: gradle
-      - name: Grant execute permission for gradlew
-        run: chmod +x gradlew
       - name: Ensure build is green
         run: ./gradlew check
       - name: Release

.github/workflows/scorecards.yml

@@ -0,0 +1,72 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Security Scorecards
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '22 18 * * 3'
+  push:
+    branches: [ "main" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecards analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@937ffa90d79c7d720498178154ad4c7ba1e4ad8c # v2.1.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecards on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@807578363a7869ca324a79039e6db9c843e0e100 # v2.1.27
+        with:
+          sarif_file: results.sarif

.github/workflows/version.yml

@@ -10,26 +10,27 @@ on:
         required: true
         default: Minor
 
+permissions:
+  contents: read
+
 concurrency: "${{ github.repository }}-versioning"
 
 jobs:
   version:
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3.2.0
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
         with:
           token: ${{ secrets.TRIGGER_GITHUB_TOKEN }}
       - name: Fetch version history
         run: git fetch --tags --unshallow
       - name: Set up JDK
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@1df8dbefe2a8cbc99770194893dd902763bee34b # v3.9.0
         with:
           java-version: '16'
           distribution: 'adopt'
           cache: gradle
-      - name: Grant execute permission for gradlew
-        run: chmod +x gradlew
       - name: Increment version
         if: contains(fromJson('["Major", "Minor", "Patch"]'), github.event.inputs.part)
         run: |

README.md

@@ -2,6 +2,7 @@
 [![Coverage Status](https://coveralls.io/repos/github/creek-service/creek-service/badge.svg?branch=main)](https://coveralls.io/github/creek-service/creek-service?branch=main)
 [![build](https://github.com/creek-service/creek-service/actions/workflows/build.yml/badge.svg)](https://github.com/creek-service/creek-service/actions/workflows/build.yml)
 [![CodeQL](https://github.com/creek-service/creek-service/actions/workflows/codeql.yml/badge.svg)](https://github.com/creek-service/creek-service/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/creek-service/creek-service/badge)](https://api.securityscorecards.dev/projects/github.com/creek-service/creek-service)
 
 # Creek Service
 

buildSrc/src/main/kotlin/creek-common-convention.gradle.kts

@@ -17,7 +17,7 @@
 /**
  * Standard configuration of Creek projects
  *
- * <p>Version: 1.1
+ * <p>Version: 1.2
  *
  * <p>Apply to all java modules, usually excluding the root project in multi-module sets.
  */
@@ -50,10 +50,10 @@ repositories {
 
     // Backup snapshot repo:
     maven {
-        url = uri("https://s01.oss.sonatype.org/content/repositories/snapshots/")
-        mavenContent {
-            includeGroup("org.creekservice")
-            snapshotsOnly()
+        url = uri("https://maven.pkg.github.com/creek-service/*")
+        credentials {
+            username = System.getenv("GITHUB_ACTOR")
+            password = System.getenv("GITHUB_TOKEN")
         }
         mavenContent {
             includeGroup("org.creekservice")

buildSrc/src/main/kotlin/creek-coverage-convention.gradle.kts

@@ -17,7 +17,7 @@
 /**
  * Standard coverage configuration of Creek projects, utilising Jacoco and Coveralls.io
  *
- * <p>Version: 1.1
+ * <p>Version: 1.2
  *
  * <p>Apply to root project only
  */
@@ -48,10 +48,10 @@ val coverage = tasks.register<JacocoReport>("coverage") {
 
     allprojects {
         val proj = this
-        // Roll results of each (test) task that has Jacoco extension, i.e. plugin applied, into the main coverage task
-        proj.tasks.matching { it.extensions.findByType<JacocoTaskExtension>() != null && it != coverageReportTask }.forEach {
+        // Roll results of each test task into the main coverage task:
+        proj.tasks.matching { it.extensions.findByType<JacocoTaskExtension>() != null }.forEach {
             coverageReportTask.sourceSets(proj.sourceSets.main.get())
-            coverageReportTask.executionData(files(proj.tasks.withType<Test>()).filter { it.exists() && it.name.endsWith(".exec") })
+            coverageReportTask.executionData(it.extensions.findByType<JacocoTaskExtension>()!!.destinationFile)
             coverageReportTask.dependsOn(it)
         }
     }