Skip to content

Commit a0a2780

Browse files
sleyter93sleyter93
authored
feat(scorecard): adding scorecard (#922)
1 parent 8b33290 commit a0a2780

File tree

6 files changed

+158
-7
lines changed

6 files changed

+158
-7
lines changed

‎.github/dependabot.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
version: 2
2+
updates:
3+
# Maintain dependencies for GitHub Actions
4+
- package-ecosystem: github-actions
5+
directory: /
6+
schedule:
7+
interval: daily
8+
# Maintain dependencies for npm
9+
- package-ecosystem: npm
10+
directory: /
11+
schedule:
12+
interval: daily
13+
# Maintain dependencies for bundler
14+
- package-ecosystem: bundler
15+
directory: /
16+
schedule:
17+
interval: daily

‎.github/workflows/android.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@ jobs:
88
install-and-test:
99
runs-on: ubuntu-latest
1010
steps:
11-
- uses: actions/checkout@v3
11+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
1212

1313
- name: Use Node.js 16.x
14-
uses: actions/setup-node@v1
14+
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a #v4.2.0
1515
with:
1616
node-version: 16.x
1717

@@ -28,10 +28,10 @@ jobs:
2828
needs: install-and-test
2929
runs-on: ubuntu-latest
3030
steps:
31-
- uses: actions/checkout@v3
31+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
3232

3333
- name: Use Node.js 16.x
34-
uses: actions/setup-node@v1
34+
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a #v4.2.0
3535
with:
3636
node-version: 16.x
3737

@@ -44,7 +44,7 @@ jobs:
4444
./gradlew app:assembleRelease
4545
4646
- name: Upload Artifact
47-
uses: actions/upload-artifact@v3
47+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 #v4.6.0
4848
with:
4949
name: app-release.apk
5050
path: android/app/build/outputs/apk/release/

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ jobs:
88
runs-on: ubuntu-latest
99

1010
steps:
11-
- uses: actions/checkout@v3
11+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
1212
- name: Use Node.js 18.x
13-
uses: actions/setup-node@v1
13+
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a #v4.2.0
1414
with:
1515
node-version: 18.x
1616

‎.github/workflows/codeql.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: "CodeQL"
2+
3+
on:
4+
push:
5+
branches: [ "main", "develop" ]
6+
pull_request:
7+
branches: [ "main", "develop" ]
8+
schedule:
9+
- cron: "0 0 * * *"
10+
11+
# Declare default permissions as read only.
12+
permissions: read-all
13+
14+
jobs:
15+
analyze:
16+
name: Analyze
17+
runs-on: ubuntu-latest
18+
permissions:
19+
actions: read
20+
contents: read
21+
security-events: write
22+
23+
strategy:
24+
fail-fast: false
25+
matrix:
26+
language: [typescript, ruby]
27+
28+
steps:
29+
- name: Checkout
30+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
31+
32+
- name: Initialize CodeQL
33+
uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
34+
with:
35+
languages: ${{ matrix.language }}
36+
queries: +security-extended
37+
38+
- name: Autobuild
39+
uses: github/codeql-action/autobuild@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
40+
41+
- name: Perform CodeQL Analysis
42+
uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
43+
with:
44+
category: "/language:${{ matrix.language }}"

‎.github/workflows/dependency_review.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: 'Dependency Review'
2+
on: [pull_request]
3+
4+
# Declare default permissions as read only.
5+
permissions: read-all
6+
7+
jobs:
8+
dependency-review:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
12+
pull-requests: write
13+
steps:
14+
- name: 'Checkout Repository'
15+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
16+
17+
- name: 'Dependency Review'
18+
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
19+
with:
20+
fail-on-severity: high
21+
comment-summary-in-pr: true

‎.github/workflows/scorecard.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: Scorecard supply-chain security
2+
on:
3+
# For Branch-Protection check. Only the default branch is supported. See
4+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
5+
branch_protection_rule:
6+
# To guarantee Maintained check is occasionally updated. See
7+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
8+
schedule:
9+
- cron: '38 2 * * 2'
10+
push:
11+
branches: [ "develop" ]
12+
13+
# Declare default permissions as read only.
14+
permissions: read-all
15+
16+
jobs:
17+
analysis:
18+
name: Scorecard analysis
19+
runs-on: ubuntu-latest
20+
permissions:
21+
# Needed to upload the results to code-scanning dashboard.
22+
security-events: write
23+
# Needed to publish results and get a badge (see publish_results below).
24+
id-token: write
25+
# Uncomment the permissions below if installing in a private repository.
26+
# contents: read
27+
# actions: read
28+
29+
steps:
30+
- name: "Checkout code"
31+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
32+
with:
33+
persist-credentials: false
34+
35+
- name: "Run analysis"
36+
uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
37+
with:
38+
results_file: results.sarif
39+
results_format: sarif
40+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
41+
# - you want to enable the Branch-Protection check on a *public* repository, or
42+
# - you are installing Scorecard on a *private* repository
43+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
44+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
45+
46+
# Public repositories:
47+
# - Publish results to OpenSSF REST API for easy access by consumers
48+
# - Allows the repository to include the Scorecard badge.
49+
# - See https://github.com/ossf/scorecard-action#publishing-results.
50+
# For private repositories:
51+
# - `publish_results` will always be set to `false`, regardless
52+
# of the value entered here.
53+
publish_results: true
54+
55+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
56+
# format to the repository Actions tab.
57+
- name: "Upload artifact"
58+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 #v4.6.0
59+
with:
60+
name: SARIF file
61+
path: results.sarif
62+
retention-days: 5
63+
64+
# Upload the results to GitHub's code scanning dashboard (optional).
65+
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
66+
- name: "Upload to code-scanning"
67+
uses: github/codeql-action/upload-sarif@17a820bf2e43b47be2c72b39cc905417bc1ab6d0 # v3.28.6
68+
with:
69+
sarif_file: results.sarif

0 commit comments

Comments
 (0)