-
Notifications
You must be signed in to change notification settings - Fork 5.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
update Scorecard Action hashes and version comments #2348
update Scorecard Action hashes and version comments #2348
Conversation
ossf/scorecard-action v2.1.2 is old and doesnt work after a Sigstore change. https://blog.sigstore.dev/tuf-root-update/ Signed-off-by: Spencer Schrock <sschrock@google.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good to me!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you @spencerschrock for the PR!
I'm requesting a single change as we don't currently support the latest version of upload-artifact
in our enterprise-server offering: https://github.com/actions/upload-artifact?tab=readme-ov-file#v4---whats-new.
If that change looks good to you, I'm happy to merge this in.
code-scanning/scorecard.yml
Outdated
@@ -59,14 +59,15 @@ jobs: | |||
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF | |||
# format to the repository Actions tab. | |||
- name: "Upload artifact" | |||
uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0 | |||
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1 | |
uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3-node20 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
On the Scorecard side, v3.1.3 is fine by me.
Are there any expected issues on GitHub's end from v3.1.3
specifying node16? Given the Spring 2024 transition?
I see there's also a v3-node20 tag, but due to some Scorecard imposed workflow restrictions when publish_results: true
I would need to make changes in our backend to support that tag since it doesn't live in main
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@spencerschrock That's a great callout and a note to my future self that we may need an additional tag for semantic versioning.
I am curious about the consideration you mentioned in your backend. Would this not need to be changed regardless as we may always introduce a new tag to fix bugs in prior versions? For instance, a 3.1.9 could be created in the future to address some newly discovered issue, which would be a divergence from main
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When publish_results
is true
, we want to check the workflow is generating legitimate scores before accepting them, as GitHub Actions allows the pinned SHA to be from the repo or a fork. So we don't want a forked ossf/scorecard-action
(or similar) to generate bogus scores.
This is specifically something we check only when pinned to a hash, so someone could always pin to a tag (e.g. @v3.1.9
).
Several of us have looked at the available APIs and there's no perfect option for "does this commit belong to the repo or a fork?". https://github.com/orgs/community/discussions/78161.
So for most repos we currently only check main
for latency purposes, based primarily on their past behavior. For github/codeql-action
we also check releases/v2
and releases/v3
as they started maintaining multiple release branches.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've made the proposed changes to this workflow. I included a github/codeql-action/upload-sarif
bump as well to move it from node16 -> node20 as well.
Done. I still need to merge ossf/scorecard-webapp#599 on my side.
dependabot will suggest upgrade to v4.3.1 for repos that can upgrade. note: v3.pre.node20 is how dependabot refers to the pinned hash, so use that so it can upgrade the comment Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: Spencer Schrock <sschrock@google.com>
ossf/scorecard-action v2.1.2 is old and is broken after a Sigstore change. https://blog.sigstore.dev/tuf-root-update/
(Also fixes #2138)
Pre-requisites
Please note that at this time we are only accepting new starter workflows for Code Scanning. Updates to existing starter workflows are fine.
Tasks
For all workflows, the workflow:
.yml
file with the language or platform as its filename, in lower, kebab-cased format (for example,docker-image.yml
). Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").GITHUB_TOKEN
so that the workflow runs successfully.For CI workflows, the workflow:
ci
directory.ci/properties/*.properties.json
file (for example,ci/properties/docker-publish.properties.json
).push
tobranches: [ $default-branch ]
andpull_request
tobranches: [ $default-branch ]
.release
withtypes: [ created ]
.docker-publish.yml
).For Code Scanning workflows, the workflow:
code-scanning
directory.code-scanning/properties/*.properties.json
file (for example,code-scanning/properties/codeql.properties.json
), with properties set as follows:name
: Name of the Code Scanning integration.creator
: Name of the organization/user producing the Code Scanning integration.description
: Short description of the Code Scanning integration.categories
: Array of languages supported by the Code Scanning integration.iconName
: Name of the SVG logo representing the Code Scanning integration. This SVG logo must be present in theicons
directory.push
tobranches: [ $default-branch, $protected-branches ]
andpull_request
tobranches: [ $default-branch ]
. We also recommend aschedule
trigger ofcron: $cron-weekly
(for example,codeql.yml
).Some general notes:
actions
organization, or