ci: add Plumber workflow security check - #936
Open
Totara-thib wants to merge 1 commit into
Open
Conversation
Runs the Plumber CLI on pushes to master and on pull requests. It statically checks the workflows under .github/workflows for supply chain risks: unpinned third-party actions, missing token permission scopes, cache restores on release paths, and similar issues, then uploads a SARIF report so findings show up in the Security tab. The .plumber.yaml overlay only records the two repo-specific differences from the built-in baseline: it trusts the assert action the smoke test uses, and keeps the branch protection control off until protection rules are enabled on master. The score badge is added to all four READMEs, per the sync rule: it works like OpenSSF Scorecard's published results and shows the current score of master.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Companion to #935, merge that one first: the check added here flags the unpinned actions and the missing permission scopes until the hardening lands, then it goes green.
This adds Plumber to CI, the tool I used to find those issues in the first place. It scans the workflows on each push to master and on each PR, and fails when something regresses: an unpinned action, a job without a permissions block, a known CVE, that kind of thing. The gate passes at 85 points, so one small finding does not block your PRs.
plumber.yml: pinned by sha, minimal permissions, findings go to the security tab as SARIF (skipped on PRs from forks, the report stays as an artifact there)..plumber.yaml: a 20 line overlay that inherits the CLI's built-in baseline, you only see what differs for this repo: the assert action the smoke test uses is trusted on top of the curated default list, and the branch protection control is off with a comment saying why (master currently has no protection rules; that is a settings switch a PR cannot flip. If you enable protection on master some day, delete those four lines and the control takes over). Everything else, including new controls in future releases, follows the defaults automatically.Score badge
I enabled
score-pushon the action. It works like OpenSSF Scorecard's published results: every run, on any branch, publishes the score to score.getplumber.io, and that feeds the badge in the README. Scores are public and the badge always shows the state of master. A failed publish never fails your CI. Until the first run the badge reads UNKNOWN in gray, then it flips to the grade. If you would rather not have it, drop the README lines and thescore-pushinput, the rest works the same.With the hardening in, this runs green with a score of A. Set
soft-fail: trueif you prefer report only, without gating PRs.To be fully transparent: I work on Plumber. If you do not want the tool in your CI, no hard feelings, the hardening PR is the one that matters and it stands on its own.