build: add Scorecards workflow #2098
Conversation
Kusari Analysis Results:
Combined security analysis shows no genuine security issues. Dependency analysis found no problematic dependency changes, code issues, or exposed secrets. Code analysis identified one false positive - a GitHub Action commit hash used for version pinning, which is actually a security best practice to prevent supply chain attacks. No vulnerabilities, workflow issues, or module security concerns were detected across both analyses. The PR is safe to merge. Note View full detailed analysis result for more information on the output and the checks that were run.
Found this helpful? Give it a 👍 or 👎 reaction! |
jamietanna
left a comment
There was a problem hiding this comment.
Before this is merged, we need to move over to Branch Rulesets (https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional)
This is another step towards better understanding this project's health, and making it clear to consumers. Although we're already onboarded via the upstream project[0] (via the "old" repo name), it's better to have this a first-class product of our project, as this also allows validating i.e. branch protection due to `permissions: read-all`. Takes configuration via Renovate's usage[1], alongside the suggested version from the Scorecard project. This uploads the SARIF results to show that we have issues in the Security tab (for maintainers). [0]: https://securityscorecards.dev/viewer/?uri=github.com%2Fdeepmap%2Foapi-codegen [1]: https://github.com/renovatebot/renovate/blob/8b86b8cdb4a3e36d6211e47a2e6a201f25f674da/.github/workflows/scorecard.yml
380b6d4 to
25a6d54
Compare
|
Kusari PR Analysis rerun based on - 25a6d54 performed at: 2025-09-24T19:33:26Z - link to updated analysis |
This is another step towards better understanding this project's health,
and making it clear to consumers.
Although we're already onboarded via the upstream project0 (via the
"old" repo name), it's better to have this a first-class product of our
project, as this also allows validating i.e. branch protection due to
permissions: read-all.Takes configuration via Renovate's usage1, alongside the suggested
version from the Scorecard project.
This uploads the SARIF results to show that we have issues in the
Security tab (for maintainers).