Skip to content

fix(security): add OpenSSF Scorecard workflow and harden SECURITY.md #155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
docdyhr merged 1 commit into from
May 27, 2026
+41 −4
Merged

fix(security): add OpenSSF Scorecard workflow and harden SECURITY.md #155

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 38 additions & 0 deletions .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
name: Scorecard supply-chain security

on:
branch_protection_rule:
schedule:
- cron: '20 14 * * 1'
push:
branches: ["main"]
Comment on lines +4 to +8

permissions: read-all

jobs:
analysis:
name: Scorecard analysis
runs-on: ubuntu-latest
permissions:
security-events: write
id-token: write
contents: read
actions: read
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false

Comment on lines +22 to +26
- name: Run analysis
uses: ossf/scorecard-action@99c09fe975337306107572b4fdf4db224cf8e2f2 # v2.4.3
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Use the actual Scorecard v2.4.3 ref

This pinned SHA is not the ossf/scorecard-action v2.4.3 release ref; the upstream v2.4.3 release points at 4eaacf0543bb3f2c246792bd56e8cdeffafb205a, while 99c09fe975337306107572b4fdf4db224cf8e2f2 does not resolve as that action release. With this uses value, GitHub Actions will fail while downloading the action, so the new workflow will never produce SARIF or publish badge results. Pin this step to a valid Scorecard action commit or tag.

Useful? React with 👍 / 👎.

with:
results_file: results.sarif
results_format: sarif
publish_results: true

Comment on lines +27 to +33
- name: Upload to code-scanning
uses: github/codeql-action/upload-sarif@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3
with:
sarif_file: results.sarif
category: scorecard
Comment on lines +34 to +38
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ Symbol indexes, token-estimated context, semantic chunks — structured output t
[![Security](https://github.com/docdyhr/batless/actions/workflows/security.yml/badge.svg?branch=main)](https://github.com/docdyhr/batless/actions/workflows/security.yml)
[![Fuzz Testing](https://github.com/docdyhr/batless/actions/workflows/fuzz.yml/badge.svg?branch=main)](https://github.com/docdyhr/batless/actions/workflows/fuzz.yml)
[![Codecov](https://codecov.io/gh/docdyhr/batless/branch/main/graph/badge.svg?logo=codecov&logoColor=white)](https://codecov.io/gh/docdyhr/batless)
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/docdyhr/batless/badge)](https://securityscorecards.dev/viewer/?uri=github.com/docdyhr/batless)

[![Rust](https://img.shields.io/badge/Rust-100%25-orange?logo=rust&logoColor=white)](https://github.com/docdyhr/batless)
[![Security Tests](https://img.shields.io/badge/security%20tests-passing-brightgreen?logo=shield&logoColor=white)](https://github.com/docdyhr/batless)
Expand Down
6 changes: 2 additions & 4 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ We take security vulnerabilities seriously. If you discover a security issue in
### Reporting Process

1. **Do NOT create a public issue** for security vulnerabilities
2. Email security concerns to: [security@batless.dev] (or create a private security advisory on GitHub)
2. **Use GitHub's private vulnerability reporting**: https://github.com/docdyhr/batless/security/advisories/new
3. Include the following information:
- Description of the vulnerability
- Steps to reproduce the issue
Expand Down Expand Up @@ -91,9 +91,7 @@ We recognize security researchers who help improve batless security:

### Contact Information

- **Security Email**: [INSERT EMAIL]
- **PGP Key**: [INSERT PGP KEY ID if available]
- **GitHub Security Advisories**: Use GitHub's private vulnerability reporting feature
- **GitHub Security Advisories**: https://github.com/docdyhr/batless/security/advisories/new

### Legal

Expand Down
Loading