fix(security): add OpenSSF Scorecard workflow and harden SECURITY.md#155
Merged
Conversation
- Add scorecard.yml to run ossf/scorecard-action weekly and on push/branch-protection-rule events so Scorecard can read the repo's ruleset with GITHUB_TOKEN and correctly report Branch-Protection; results are published and uploaded to GitHub code-scanning - Enable private vulnerability reporting (GHSA) on the repository - Replace placeholder emails in SECURITY.md with the GitHub Security Advisories URL - Add OpenSSF Scorecard badge to README Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewer's GuideAdds an OpenSSF Scorecard GitHub Actions workflow, surfaces its results via a README badge and SARIF uploads, and hardens SECURITY.md to use GitHub private vulnerability reporting instead of placeholder contact details. Sequence diagram for OpenSSF Scorecard GitHub Actions workflowsequenceDiagram
actor Developer
participant GitHub
participant ActionsRunner
participant actions_checkout
participant scorecard_action
participant OpenSSF_API
participant codeql_upload_sarif
participant Code_Scanning
Developer->>GitHub: push main / schedule / branch_protection_rule
GitHub-->>ActionsRunner: start workflow scorecard.yml
ActionsRunner->>actions_checkout: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
actions_checkout-->>ActionsRunner: repository contents
ActionsRunner->>scorecard_action: ossf/scorecard-action@99c09fe975337306107572b4fdf4db224cf8e2f2
scorecard_action-->>OpenSSF_API: publish_results true
scorecard_action-->>ActionsRunner: results.sarif
ActionsRunner->>codeql_upload_sarif: github/codeql-action/upload-sarif@03e4368ac7daa2bd82b3e85262f3bf87ee112f57
codeql_upload_sarif-->>Code_Scanning: upload results.sarif category scorecard
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- Consider replacing the top-level
permissions: read-allwith the minimal permissions actually required (and inheriting job-level overrides as needed) to further tighten the workflow’s security posture. - In
SECURITY.md, you might use a repository-relative link (./security/advisories/new) instead of a fully qualified URL so the advisory link continues to work if the repo is renamed or forked.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider replacing the top-level `permissions: read-all` with the minimal permissions actually required (and inheriting job-level overrides as needed) to further tighten the workflow’s security posture.
- In `SECURITY.md`, you might use a repository-relative link (`./security/advisories/new`) instead of a fully qualified URL so the advisory link continues to work if the repo is renamed or forked.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
There was a problem hiding this comment.
Pull request overview
This PR improves the repository’s supply-chain/security posture by adding a dedicated OpenSSF Scorecard workflow (with publishing + SARIF upload) and by updating public security reporting guidance and documentation to point to GitHub’s private vulnerability reporting flow.
Changes:
- Add a new GitHub Actions workflow to run OpenSSF Scorecard on schedule, on pushes to
main, and onbranch_protection_ruleevents, publishing results and uploading SARIF. - Update
SECURITY.mdto remove placeholder email/PGP fields and direct reporters to GitHub Security Advisories. - Add an OpenSSF Scorecard badge to
README.md.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
.github/workflows/scorecard.yml |
Adds a dedicated Scorecard workflow intended to publish results and upload SARIF to Code Scanning. |
SECURITY.md |
Replaces placeholder contact info with a direct link to GitHub private vulnerability reporting. |
README.md |
Adds an OpenSSF Scorecard badge to surface the project’s Scorecard status. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+4
to
+8
| branch_protection_rule: | ||
| schedule: | ||
| - cron: '20 14 * * 1' | ||
| push: | ||
| branches: ["main"] |
Comment on lines
+27
to
+33
| - name: Run analysis | ||
| uses: ossf/scorecard-action@99c09fe975337306107572b4fdf4db224cf8e2f2 # v2.4.3 | ||
| with: | ||
| results_file: results.sarif | ||
| results_format: sarif | ||
| publish_results: true | ||
|
|
| publish_results: true | ||
|
|
||
| - name: Upload to code-scanning | ||
| uses: github/codeql-action/upload-sarif@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3 |
Comment on lines
+34
to
+38
| - name: Upload to code-scanning | ||
| uses: github/codeql-action/upload-sarif@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3 | ||
| with: | ||
| sarif_file: results.sarif | ||
| category: scorecard |
Comment on lines
+22
to
+26
| - name: Checkout code | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| with: | ||
| persist-credentials: false | ||
|
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 75003ef617
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| persist-credentials: false | ||
|
|
||
| - name: Run analysis | ||
| uses: ossf/scorecard-action@99c09fe975337306107572b4fdf4db224cf8e2f2 # v2.4.3 |
There was a problem hiding this comment.
This pinned SHA is not the ossf/scorecard-action v2.4.3 release ref; the upstream v2.4.3 release points at 4eaacf0543bb3f2c246792bd56e8cdeffafb205a, while 99c09fe975337306107572b4fdf4db224cf8e2f2 does not resolve as that action release. With this uses value, GitHub Actions will fail while downloading the action, so the new workflow will never produce SARIF or publish badge results. Pin this step to a valid Scorecard action commit or tag.
Useful? React with 👍 / 👎.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses the three OpenSSF Scorecard findings from the latest scan.
scorecard.ymlso Scorecard runs withGITHUB_TOKENand can read the existing repository ruleset. Results are published to the OpenSSF API and uploaded to GitHub Code Scanning (SARIF).SECURITY.md, replacing them with the GitHub Security Advisories URL.Changes
.github/workflows/scorecard.yml— new workflow usingossf/scorecard-action@v2.4.3(pinned SHA), runs weekly + on push to main + on branch-protection-rule eventsSECURITY.md— remove[security@batless.dev],[INSERT EMAIL],[INSERT PGP KEY ID]placeholders; replace withhttps://github.com/docdyhr/batless/security/advisories/newREADME.md— add OpenSSF Scorecard badgeTest plan
🤖 Generated with Claude Code
Summary by Sourcery
Add automated OpenSSF Scorecard supply-chain security analysis and tighten documented security reporting channels.
New Features:
Enhancements: