chore: add OpenSSF Scorecard workflow #2334
Conversation
Add OpenSSF Scorecard for security scoring and visibility. Results are published to GitHub Security tab. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
kubestellar-prow
bot
added
the
dco-signoff: no
|
Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits. 📝 Please follow instructions in the contributing guide to update your commits with the DCO Full details of the Developer Certificate of Origin can be found at developercertificate.org. The list of commits missing DCO signoff:
DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
kubestellar-prow
bot
added
the
size/M
There was a problem hiding this comment.
Pull request overview
This PR adds an OpenSSF Scorecard workflow to automate security scoring for the repository. The workflow runs weekly, on pushes to the main branch, and can be triggered manually.
Changes:
- Added OpenSSF Scorecard GitHub Actions workflow
- Configured security permissions for SARIF uploads and badge generation
- Set up automated scanning schedule and artifact retention
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| persist-credentials: false | ||
|
|
||
| - name: Run analysis | ||
| uses: ossf/scorecard-action@v2.4.0 |
There was a problem hiding this comment.
Pin the action to a full commit SHA instead of a version tag to ensure immutability and prevent potential supply chain attacks. Version tags can be moved or deleted, but commit SHAs are permanent.
| uses: ossf/scorecard-action@v2.4.0 | |
| uses: ossf/scorecard-action@62b2cac7ed819b70a90c1c9f236b4f1e77f4a24b |
github-project-automation
bot
moved this from In Progress
to Done
in KubeStellar UI Project
|
🎉 Thank you for your contribution! Your PR has been successfully merged. We’d love to hear your thoughts to help improve KubeStellar. |
Add OpenSSF Scorecard for security scoring and visibility. Results are published to GitHub Security tab. Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Signed-off-by: mrhapile <allinonegaming3456@gmail.com>
|
@clubanderson: The following tests failed, say
DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/retest |
1 similar comment
|
/retest |
|
/test all |
Summary
Add OpenSSF Scorecard workflow for security scoring and visibility.
Details
🤖 Generated with Claude Code