From d72a1e7004af15b7774bd86bd2f467c2a6fa734f Mon Sep 17 00:00:00 2001 From: Joyce Brum Date: Mon, 31 Oct 2022 11:31:20 -0300 Subject: [PATCH 1/7] chore: enable openSSF scorecard action and badge Signed-off-by: Joyce Brum --- .github/workflows/scorecards.yml | 62 ++++++++++++++++++++++++++++++++ README.md | 2 +- 2 files changed, 63 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/scorecards.yml diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml new file mode 100644 index 000000000000..359aff4e7695 --- /dev/null +++ b/.github/workflows/scorecards.yml @@ -0,0 +1,62 @@ +name: Scorecards supply-chain security +on: + # Only the default branch is supported. + branch_protection_rule: + schedule: + - cron: '16 10 * * 6' + push: + branches: [ "main" ] + +# Declare default permissions as read only. +permissions: read-all + +jobs: + analysis: + name: Scorecards analysis + runs-on: ubuntu-latest + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + # Used to receive a badge. + id-token: write + # Needs for private repositories. + contents: read + actions: read + + steps: + - name: "Checkout code" + uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@99c53751e09b9529366343771cc321ec74e9bd3d # tag=v2.0.6 + with: + results_file: results.sarif + results_format: sarif + # (Optional) Read-only PAT token. Uncomment the `repo_token` line below if: + # - you want to enable the Branch-Protection check on a *public* repository, or + # - you are installing Scorecards on a *private* repository + # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. + # repo_token: ${{ secrets.SCORECARD_READ_TOKEN }} + + # Publish the results for public repositories to enable scorecard badges. For more details, see + # https://github.com/ossf/scorecard-action#publishing-results. + # For private repositories, `publish_results` will automatically be set to `false`, regardless + # of the value entered here. + publish_results: true + + # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF + # format to the repository Actions tab. + - name: "Upload artifact" + uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # tag=v3.0.0 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard. + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26 + with: + sarif_file: results.sarif diff --git a/README.md b/README.md index 5ad3d909468e..2a438272e7cd 100644 --- a/README.md +++ b/README.md @@ -72,7 +72,7 @@ Read the [Getting started page](https://getbootstrap.com/docs/5.2/getting-starte [![BrowserStack Status](https://www.browserstack.com/automate/badge.svg?badge_key=SkxZcStBeExEdVJqQ2hWYnlWckpkNmNEY213SFp6WHFETWk2bGFuY3pCbz0tLXhqbHJsVlZhQnRBdEpod3NLSDMzaHc9PQ==--3d0b75245708616eb93113221beece33e680b229)](https://www.browserstack.com/automate/public-build/SkxZcStBeExEdVJqQ2hWYnlWckpkNmNEY213SFp6WHFETWk2bGFuY3pCbz0tLXhqbHJsVlZhQnRBdEpod3NLSDMzaHc9PQ==--3d0b75245708616eb93113221beece33e680b229) [![Backers on Open Collective](https://img.shields.io/opencollective/backers/bootstrap)](#backers) [![Sponsors on Open Collective](https://img.shields.io/opencollective/sponsors/bootstrap)](#sponsors) - +[![OpenSSF Scorecard](https://img.shields.io/ossf-scorecard/github.com/twbs/bootstrap)](https://api.securityscorecards.dev/projects/github.com/twbs/bootstrap) ## What's included From 906997890b444d2c65b1b7a59675af44afdedaf9 Mon Sep 17 00:00:00 2001 From: XhmikosR Date: Mon, 31 Oct 2022 18:08:13 +0200 Subject: [PATCH 2/7] Update README.md --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 2a438272e7cd..04cc7ab04deb 100644 --- a/README.md +++ b/README.md @@ -74,6 +74,7 @@ Read the [Getting started page](https://getbootstrap.com/docs/5.2/getting-starte [![Sponsors on Open Collective](https://img.shields.io/opencollective/sponsors/bootstrap)](#sponsors) [![OpenSSF Scorecard](https://img.shields.io/ossf-scorecard/github.com/twbs/bootstrap)](https://api.securityscorecards.dev/projects/github.com/twbs/bootstrap) + ## What's included Within the download you'll find the following directories and files, logically grouping common assets and providing both compiled and minified variations. From 7449cc4f3e90fd2c8d6ea6c7b272eb7d1895860f Mon Sep 17 00:00:00 2001 From: Joyce Brum Date: Mon, 31 Oct 2022 14:55:55 -0300 Subject: [PATCH 3/7] fix: change hash-pinning to tag-pinning Signed-off-by: Joyce Brum --- .github/workflows/scorecards.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 359aff4e7695..0fd5f4b094ec 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -25,12 +25,12 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0 + uses: actions/checkout@v3.0.0 with: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@99c53751e09b9529366343771cc321ec74e9bd3d # tag=v2.0.6 + uses: ossf/scorecard-action@v2.0.6 with: results_file: results.sarif results_format: sarif @@ -49,7 +49,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # tag=v3.0.0 + uses: actions/upload-artifact@v3.0.0 with: name: SARIF file path: results.sarif @@ -57,6 +57,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26 + uses: github/codeql-action/upload-sarif@v1.0.26 with: sarif_file: results.sarif From 5395fd5682f97b721f2727538ca87841e77dd408 Mon Sep 17 00:00:00 2001 From: XhmikosR Date: Sun, 13 Nov 2022 09:47:44 +0200 Subject: [PATCH 4/7] Update scorecards.yml --- .github/workflows/scorecards.yml | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 0fd5f4b094ec..02845abd987a 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -1,11 +1,14 @@ name: Scorecards supply-chain security + on: # Only the default branch is supported. branch_protection_rule: - schedule: - - cron: '16 10 * * 6' push: - branches: [ "main" ] + branches: + - main + schedule: + - cron: "16 10 * * 6" + workflow_dispatch: # Declare default permissions as read only. permissions: read-all @@ -24,12 +27,12 @@ jobs: actions: read steps: - - name: "Checkout code" - uses: actions/checkout@v3.0.0 + - name: Checkout repository + uses: actions/checkout@v3 with: persist-credentials: false - - name: "Run analysis" + - name: Run analysis uses: ossf/scorecard-action@v2.0.6 with: results_file: results.sarif @@ -48,15 +51,15 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - - name: "Upload artifact" - uses: actions/upload-artifact@v3.0.0 + - name: Upload artifact + uses: actions/upload-artifact@v3 with: name: SARIF file path: results.sarif retention-days: 5 # Upload the results to GitHub's code scanning dashboard. - - name: "Upload to code-scanning" + - name: Upload to code-scanning uses: github/codeql-action/upload-sarif@v1.0.26 with: sarif_file: results.sarif From a59a4818f898af38a1eb6126493a8875fb2d49cf Mon Sep 17 00:00:00 2001 From: XhmikosR Date: Sun, 13 Nov 2022 09:49:37 +0200 Subject: [PATCH 5/7] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 04cc7ab04deb..4fde774b43d5 100644 --- a/README.md +++ b/README.md @@ -72,7 +72,7 @@ Read the [Getting started page](https://getbootstrap.com/docs/5.2/getting-starte [![BrowserStack Status](https://www.browserstack.com/automate/badge.svg?badge_key=SkxZcStBeExEdVJqQ2hWYnlWckpkNmNEY213SFp6WHFETWk2bGFuY3pCbz0tLXhqbHJsVlZhQnRBdEpod3NLSDMzaHc9PQ==--3d0b75245708616eb93113221beece33e680b229)](https://www.browserstack.com/automate/public-build/SkxZcStBeExEdVJqQ2hWYnlWckpkNmNEY213SFp6WHFETWk2bGFuY3pCbz0tLXhqbHJsVlZhQnRBdEpod3NLSDMzaHc9PQ==--3d0b75245708616eb93113221beece33e680b229) [![Backers on Open Collective](https://img.shields.io/opencollective/backers/bootstrap)](#backers) [![Sponsors on Open Collective](https://img.shields.io/opencollective/sponsors/bootstrap)](#sponsors) -[![OpenSSF Scorecard](https://img.shields.io/ossf-scorecard/github.com/twbs/bootstrap)](https://api.securityscorecards.dev/projects/github.com/twbs/bootstrap) +![OpenSSF Scorecard](https://img.shields.io/ossf-scorecard/github.com/twbs/bootstrap) ## What's included From 89fa3f965c685c45b3321d6ab2910a9b607308b8 Mon Sep 17 00:00:00 2001 From: XhmikosR Date: Sun, 13 Nov 2022 09:50:34 +0200 Subject: [PATCH 6/7] Update scorecards.yml --- .github/workflows/scorecards.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 02845abd987a..bb752a6b8242 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -27,7 +27,7 @@ jobs: actions: read steps: - - name: Checkout repository + - name: Clone repository uses: actions/checkout@v3 with: persist-credentials: false From e7bd8674ff25ff9558600c4256915540b5c53a38 Mon Sep 17 00:00:00 2001 From: XhmikosR Date: Fri, 16 Dec 2022 09:29:59 +0200 Subject: [PATCH 7/7] Update scorecards.yml --- .github/workflows/scorecards.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index bb752a6b8242..19ceb8e0db91 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -33,7 +33,7 @@ jobs: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@v2.0.6 + uses: ossf/scorecard-action@v2.1.0 with: results_file: results.sarif results_format: sarif @@ -60,6 +60,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@v1.0.26 + uses: github/codeql-action/upload-sarif@v1 with: sarif_file: results.sarif