feat: migration to OpenSSF - #1
Conversation
Signed-off-by: Eddie Knight <knight@linux.com>
Kusari Analysis Results:
Both analyses independently recommend PROCEED. Dependency review found one advisory (GO-2026-5932, golang.org/x/crypto openpgp, unmaintained/unsafe by design) but it has NO_FIX status with no upgrade path available, making it unactionable for this PR; a license review is recommended for several MPL-2.0 and CC-BY-SA-4.0 packages before merging but is not blocking. Code analysis found no secrets or critical code issues; three Low confidence workflow findings were assessed as informational or false positives (GITHUB_PATH write uses only fixed internal values, and the cosign digest is server-side computed, not attacker-controlled). One hardening item remains: actions/setup-go caching (cache: true) in the privileged release.yml job (packages:write, id-token:write) increases cache-poisoning exposure for signed release artifacts; recommend setting cache: false as a hardening measure. Combined, no critical or actionable blocking issues were identified; recommended action items are license confirmation and disabling setup-go caching in the release workflow before merging. Note View full detailed analysis result for more information on the output and the checks that were run.
Found this helpful? Give it a 👍 or 👎 reaction! |
![kusari-inspector[bot]](https://avatars.githubusercontent.com/in/1220830?s=60&v=4){kind=small}
|
Kusari PR Analysis rerun based on - a990a78 performed at: 2026-09-03T20:03:02Z - link to updated analysis |
a990a78 to
9a292f3
Compare
|
Kusari PR Analysis rerun based on - 9a292f3 performed at: 2026-09-03T20:04:43Z - link to updated analysis |
|
Kusari PR Analysis rerun based on - aa04610 performed at: 2026-09-03T20:14:42Z - link to updated analysis |
|
Kusari PR Analysis rerun based on - 1f8b59c performed at: 2026-09-03T20:45:01Z - link to updated analysis |
Workflows: route inputs.grcli-version and github.actor through env vars instead of interpolating them into run: blocks (command injection). Dependencies: google.golang.org/grpc v1.83.2, oras.land/oras-go/v2 v2.6.2, github.com/sigstore/sigstore-go v1.3.0, golang.org/x/crypto v0.56.0, per the flagged advisories. Signed-off-by: Eddie Knight <knight@linux.com>
This repo supersedes revanite-io/grcli entirely, so: - Go module path renamed to github.com/gemaraproj/grcli (no external importers exist; grcli is a leaf). Imports, Makefile PKG and the release ldflags follow. - Reusable publish-gemara workflow installs from ghcr.io/gemaraproj/grcli and defaults to v0.7.0 (was a v0.3.0 pin at the old registry). - Install action, example workflow, README and CLAUDE.md drop the "older tags live at revanite-io" caveats; pins move to v0.7.0. - CHANGELOG gains an Unreleased entry for the module rename. Signed-off-by: Eddie Knight <knight@linux.com>
Pins, workflow defaults and docs now target v0.1.0. CHANGELOG is reset to a single 0.1.0 entry describing current capabilities, and the comments that cited earlier releases as history are reworded. Signed-off-by: Eddie Knight <knight@linux.com>
Signed-off-by: Eddie Knight <knight@linux.com>
… persistence - Pin actions/checkout (v4.4.0), actions/setup-go (v5.6.0), golangci-lint-action (v9.3.0) and sigstore/cosign-installer (v3.9.2) to commit SHAs across ci.yml, release.yml, publish-gemara.yml and the example workflow. - Set persist-credentials: false on every checkout step. - Bump golang.org/x/mod to v0.40.0 (GO-2026-6179 / GO-2026-6180). Signed-off-by: Eddie Knight <knight@linux.com>
…es, fix doc placement - provenance: strip credentials from remote.origin.url before it is stamped into signed, immutable provenance (https://user:token@host/... remotes). - cache: digestOf now calls internal/digest.Bytes instead of duplicating it. - registry: move FetchSignatureBundle's doc block onto FetchSignatureBundle; it sat above AttachSignatureReferrer. - sign: rewrap the 136-char comment line left by the ADR strip. Signed-off-by: Eddie Knight <knight@linux.com>
- publish-gemara.yml: drop the cosign-installer step; keyless signing is in-process and never looks for cosign (sign.Preflight). - install action: resolve the tag once and verify + pull by digest, so a retag between the two steps cannot install an unverified binary. - Gate tidycheck in ci-local and CI. - Add CONTRIBUTING.md (DCO sign-off, dev loop) and SECURITY.md. - release.yml: header rewritten for a public repo and package. - CLAUDE.md: replace umbrella-relative paths that resolve nowhere in a standalone clone. - .gitignore: restore go.work / go.work.sum. - examples: drop the dated smoke-test note. Signed-off-by: Eddie Knight <knight@linux.com>
Kusari flagged module caching in a job holding packages:write and id-token:write as cache-poisoning exposure for signed release artifacts. Signed-off-by: Eddie Knight <knight@linux.com>
247d4b6 to
d1cc1a0
Compare
2 participants
To simplify the grcli contribution, instead of a repo migration, OpenSSF staff requested that we make a PR to a clean repo with a DCO check and clean license content all at once up front.
Following this PR, we will need to update any places that ingest grcli to use the new release channel, as auto-linking will be disconnected.