Strengthening Branch Protection Rules for Improved OpenSSF Scorecard Compliance

[asmit27rai]

Background

As part of the CNCF KubeArmor Supply Chain Security and OpenSSF Scorecard hardening effort, I explored branch protection configurations in my fork and observed that the OpenSSF Scorecard Branch-Protection check achieved a score of 10/10 after enabling a comprehensive set of protections.

Configuration Tested

The following protections were enabled on the * branch:

Pull Request Requirements

• Require pull requests before merging
• Require at least 2 approvals
• Require review from Code Owners
• Require approval of the most recent reviewable push

Branch Safety

• Restrict branch deletions
• Block force pushes

Required Status Checks

• Require branches to be up to date before merging
• Required checks:
  • DCO
  • ci-codespell
  • CodeQL
  • Code scanning results

Observed Result

After enabling the above protections in my fork, the OpenSSF Scorecard Branch-Protection check reported a score of 10/10.

Questions for Maintainers

I would appreciate feedback from the maintainers on the following points:

1. Are these branch protection requirements compatible with KubeArmor's current development workflow?
2. Would requiring two approvals be practical for all pull requests?
3. Are there additional status checks that should be considered mandatory?

Thank you.

CCing: @Aryan-sharma11 @daemon1024 @achrefbensaad

[Aryan-sharma11]

Pull Request Requirements

• Require pull requests before merging
• Require at least 2 approvals
• Require review from Code Owners
• Require approval of the most recent reviewable push

Branch Safety

• Restrict branch deletions
• Block force pushes

@achrefbensaad Currently we have these rules already set for main branch, should we extend it to for all the branches? wdyt?

[Aryan-sharma11]

A ruleset for the main branch was already in place. I've now created a separate ruleset for the release branches as well, so the changes should be reflected in the OpenSSF Scorecard once it refreshes.
cc @achrefbensaad @asmit27rai

[Aryan-sharma11]

Hi @asmit27rai, the proposed changes have been completed, and the Branch Protection score is now 10.