-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Improvement of OpenSSF Scorecard Score #4601
Comments
Thanks!
|
By the way, it might be better to split the Fuzzing and CI-Tests issue because it becomes long standing topics. Crossover topics in one issue is not desirable, IMHO. |
@harshitasao could you create a separated issue for Fuzzing and CI-Tests respectively? I'll close this issue not to mixin these topics. (should focus on one topic in every issue) |
Is your feature request related to a problem? Please describe.
Hi, I'm Harshita. I’m working with CNCF and the Google Open Source Security Team for the GSoC 2024 term. We are collaborating to enhance security practices across various CNCF projects. The goal is to improve security for all CNCF projects by both using OpenSSF Scorecards and implementing its security improvements.
Describe the solution you'd like
As this project already has scorecard action, I'm here to increase the final score by going over each check. I've listed all of the checks where work needs to be done, in order of its criticality. I plan to submit each PR for each fix. Please let me know what you think and for which ones a PR is welcome that I will submit it ASAP.
Current Score: 8.2
Scorecard report: https://scorecard.dev/viewer/?uri=github.com/fluent/fluentd
Here's a few checks we can work on to improve the project's security posture:
Fuzzing: Score = 0
Pinned-Dependencies: Score = 2
CI-Tests: Score = 6
- This check tries to determine if the project runs tests before pull requests are merged.
- To remediate this check, 1. Check-in scripts that run all the tests in the repository. 2. Integrate those scripts with a CI/CD platform that runs it on every pull request.
Describe alternatives you've considered
N/A
Additional context
/cc @joycebrum @diogoteles08 @pnacht @nate-double-u
The text was updated successfully, but these errors were encountered: