ci: OpenSSF Scorecard + zizmor workflow SAST + branch-protection script - #21
Merged
Conversation
…ript Scorecard (scheduled, own file) scores supply-chain posture and backs a README badge; zizmor (pinned CLI via pipx, no new marketplace action) statically analyzes the workflows for injection/permissions/pinning footguns, gated at medium+. setup-branch-protection.sh applies main protection (require PR + green CI, 0 reviews for a solo maintainer, linear history, no force-push) — the maintainer runs it. All actions SHA-pinned; least-privilege per-job permissions. The runtime binary stays zero-dependency — this is CI tooling only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CI/CD security hardening — three additions. The runtime binary stays zero-dependency; this is CI tooling only.
.github/workflows/scorecard.yml, scheduled + push to main) — scores supply-chain posture (branch protection, pinned deps, token perms, …) and backs a README badge. OIDC (no secret), SHA-pinned, own file (different trigger/cadence).ci.yml) — GitHub Actions SAST over our workflows (injection sinks, excessive permissions, unpinned actions, credential persistence). Run as a pinned CLI (pipx run zizmor==1.25.2) — no new marketplace action. Gated at--min-severity medium. First real run is this PR.scripts/setup-branch-protection.sh— appliesmainprotection: require PR + green CI, 0 required reviews (solo maintainer; CI is the gate), linear history, no force-push/deletion, enforce for admins. Maintainer runs it.All actions SHA-pinned (SEC-011); least-privilege per-job
permissions.After merge (maintainer)
scripts/setup-branch-protection.sh(needs repo-admingh auth).api.securityscorecards.dev.Sequencing note: this lands the workflows first so the
zizmor/scorecardchecks exist; branch protection is applied after.