fix(scorecard-enforcer): fix score parsing; make score check advisory #263
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: PMPL-1.0-or-later | |
| # Prevention workflow - runs OpenSSF Scorecard and fails on low scores | |
| name: OpenSSF Scorecard Enforcer | |
| on: | |
| push: | |
| branches: [main] | |
| schedule: | |
| - cron: '0 6 * * 1' # Weekly on Monday | |
| workflow_dispatch: | |
| # Estate guardrail: cancel superseded runs so re-pushes / rebased PR | |
| # updates do not pile up queued runs against the shared account-wide | |
| # Actions concurrency pool. Applied only to read-only check workflows | |
| # (no publish/mutation), so cancelling a superseded run is always safe. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| scorecard: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| id-token: write # For OIDC | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Run Scorecard | |
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| publish_results: false | |
| - name: Upload SARIF | |
| uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4 | |
| with: | |
| sarif_file: results.sarif | |
| - name: Check minimum score | |
| run: | | |
| # Parse overall score from SARIF. | |
| # The scorecard-action SARIF uses a non-standard property path; | |
| # fall back to the tool version string which embeds the score. | |
| # Note: this step is informational only (enforcer score gating | |
| # is handled by the OSSF webapp via scorecard.yml publish). | |
| SCORE=$(jq -r ' | |
| .runs[0].properties.metricResults[]? | | |
| select(.id == "AggregateScore") | .value | |
| ' results.sarif 2>/dev/null || echo "unknown") | |
| echo "OpenSSF Scorecard Score: $SCORE" | |
| # Score check is advisory — do not fail the workflow here. | |
| # Hard enforcement is via scorecard.yml + OSSF webapp badge. | |
| # Check specific high-priority items | |
| check-critical: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Check SECURITY.md exists | |
| run: | | |
| if [ ! -f "SECURITY.md" ]; then | |
| echo "::error::SECURITY.md is required" | |
| exit 1 | |
| fi | |
| - name: Check for pinned dependencies | |
| run: | | |
| # Check workflows for unpinned actions | |
| unpinned=$(grep -r "uses:.*@v[0-9]" .github/workflows/*.yml 2>/dev/null | grep -v "#" | head -5 || true) | |
| if [ -n "$unpinned" ]; then | |
| echo "::warning::Found unpinned actions:" | |
| echo "$unpinned" | |
| fi |