Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for OSSF scorecard reporting #5431

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add support for OSSF scorecard reporting #5431

wants to merge 1 commit into from
+72 −0

Conversation

UlisesGascon
Copy link
Member

Main Changes

This pipeline will proactively report the status of the project (every day and when a push is done to master branch) including critical fields (CI-Tests, Contributors, Dependency-Update-Tool, Webhooks) that are missing while running via OSSF cron jobs.

Context

Changes related

It's also possible that some repositories in your organization are already being automatically tracked by OpenSSF in this CSV file via weekly cronjob. One caveat: Automatically tracked projects do not include ossf/scorecard#3438 in their analysis (CI-Tests,Contributors,Dependency-Update-Tool,Webhooks).
Source: openssf-scorecard-monitor documentation

Team discussion related

Changelog

@UlisesGascon UlisesGascon marked this pull request as ready for review February 2, 2024 15:44
@UlisesGascon UlisesGascon mentioned this pull request Feb 22, 2024
Open
inigomarquinez
inigomarquinez approved these changes Mar 17, 2024
View reviewed changes
Copy link
Member

@inigomarquinez inigomarquinez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@UlisesGascon UlisesGascon mentioned this pull request Apr 16, 2024
Open
@UlisesGascon UlisesGascon added the semver-ignore This change does not have any impact in semver (docs, tooling, etc..) label Apr 17, 2024
@bjohansebas
Copy link
Member

I think it's the only repository where the scorecard integration is missing

@UlisesGascon
Copy link
Member Author

One more approval from the TC team and I can merge it 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@inigomarquinez inigomarquinez inigomarquinez approved these changes

@bjohansebas bjohansebas bjohansebas approved these changes

@ctcpip ctcpip Awaiting requested review from ctcpip

@wesleytodd wesleytodd Awaiting requested review from wesleytodd

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
semver-ignore This change does not have any impact in semver (docs, tooling, etc..)
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@UlisesGascon @bjohansebas @inigomarquinez