Work on OpenSSF Scorecard Report

[mathbunnyru]

Right now it's 6.2 https://scorecard.dev/viewer/?uri=github.com%2Fjupyter%2Fdocker-stacks

Are you a maintainer?

• Yes, I am a maintainer

[goelakash]

@mathbunnyru is there anything here that warrants special attention? I could maybe take a look.

[goelakash]

I was going through the scorecard items with the lowest scores to prioritize work here. The CII-Best-Practices check is at zero because no badge has been registered yet.

I looked into it and it requires a maintainer to register the project at https://www.bestpractices.dev/ and fill out a self-assessment questionnaire. Most of the criteria (version control, automated tests, security policy, license, documentation) should already be met, so it's mainly a matter of going through the form.

@mathbunnyru would you be open to registering for this? Happy to help fill in details if needed.

[mathbunnyru]

I was going through the scorecard items with the lowest scores to prioritize work here. The CII-Best-Practices check is at zero because no badge has been registered yet.

I looked into it and it requires a maintainer to register the project at bestpractices.dev and fill out a self-assessment questionnaire. Most of the criteria (version control, automated tests, security policy, license, documentation) should already be met, so it's mainly a matter of going through the form.

@mathbunnyru would you be open to registering for this? Happy to help fill in details if needed.

Yes, I'll do it, thanks, but it will take a bit of time, since I'm pretty busy lately.
Thanks for working this issue, though!

[goelakash]

@mathbunnyru
A few branch protection settings that would improve the score for Branch Protection and Code-Review (Settings > Branches > main rule) could also lead to a quick impvements ("Include administrators", "Require review from Code Owners", "Require approval of the most recent reviewable push")

The score has moved from 6.2 --> 7.8 thanks to the recent PRs merged :D

[goelakash]

Images are currently published unsigned, which is why the Signed-Releases check scores zero. Opened #2455 to track adding cosign keyless signing to the publish workflow.

[mathbunnyru]

@mathbunnyru A few branch protection settings that would improve the score for Branch Protection and Code-Review (Settings > Branches > main rule) could also lead to a quick impvements ("Include administrators", "Require review from Code Owners", "Require approval of the most recent reviewable push")

The score has moved from 6.2 --> 7.8 thanks to the recent PRs merged :D

I enabled "Require review from Code Owners" and "Require approval of the most recent reviewable push"
About administrators - it's explicitly only me right now, and I won't be changing that, because sometimes CodeQL checks are really slow, so I don't want to wait for them.

[goelakash]

Great, those should probably further show an improvement.

[mathbunnyru]

8.1 now :)

It will be fluctuating because I mostly don't require my PRs to be approved (unless I believe they should be reviewed) - this allowed this project to move forward and not have too many issues.