common: Add OpenSSF Scorecard gating workflow

common/.github/workflows/openssf-scorecard-gate.yml

@@ -0,0 +1,28 @@
+# Gate PRs on OpenSSF Scorecard regressions.
+#
+# See also: https://github.com/ossf/scorecard/issues/1270
+name: OpenSSF Scorecard
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  scorecard:
+    name: Scorecard
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check for regressions
+        uses: bootc-dev/actions/openssf-scorecard@main
+        with:
+          base-sha: ${{ github.event.pull_request.base.sha }}
+          head-sha: ${{ github.event.pull_request.head.sha }}

devenv/Containerfile.c10s

@@ -1,7 +1,7 @@
 # These aren't packages, just low-dependency binaries dropped in /usr/local/bin
 # so we can fetch them independently in a separate build.
 ARG base=quay.io/centos/centos:stream10
 FROM $base as base
 # Life is too short to care about dash
 RUN ln -sfr /bin/bash /bin/sh
 RUN <<EORUN
@@ -25,11 +25,13 @@
 dnf -y makecache
 EORUN
 
 FROM base as tools
 # renovate: datasource=github-releases depName=block/goose
 ARG gooseversion=v1.11.1
 # renovate: datasource=github-releases depName=bootc-dev/bcvk
 ARG bcvkversion=v0.9.0
+# renovate: datasource=github-releases depName=ossf/scorecard
+ARG scorecardversion=v5.1.1
 RUN <<EORUN
 set -xeuo pipefail
 arch=$(arch)
@@ -58,9 +60,26 @@
 else
   echo bcvk unavailable for $arch
 fi
+
+# scorecard (OpenSSF security scanner)
+td=$(mktemp -d)
+(
+  cd $td
+  # Map arch to scorecard naming convention
+  case "${arch}" in
+    x86_64) scarch=amd64 ;;
+    aarch64) scarch=arm64 ;;
+    *) echo "scorecard unavailable for $arch"; exit 0 ;;
+  esac
+  target=scorecard_${scorecardversion#v}_linux_${scarch}.tar.gz
+  /bin/time -f '%E %C' curl -fLO https://github.com/ossf/scorecard/releases/download/$scorecardversion/$target
+  tar xvzf $target
+  mv scorecard /usr/local/bin/scorecard
+)
+rm -rf $td
 EORUN
 
 FROM base as rust
 RUN <<EORUN
 set -xeuo pipefail
 # Setup rust; the idea here though is we install system-wide into /usr/local

devenv/Containerfile.debian

@@ -1,7 +1,7 @@
 # These aren't packages, just low-dependency binaries dropped in /usr/local/bin
 # so we can fetch them independently in a separate build.
 ARG base=docker.io/library/debian:sid
 FROM $base as base
 # Life is too short to care about dash
 RUN ln -sfr /bin/bash /bin/sh
 RUN <<EORUN
@@ -25,11 +25,13 @@
 apt -y update
 EORUN
 
 FROM base as tools
 # renovate: datasource=github-releases depName=block/goose
 ARG gooseversion=v1.11.1
 # renovate: datasource=github-releases depName=bootc-dev/bcvk
 ARG bcvkversion=v0.9.0
+# renovate: datasource=github-releases depName=ossf/scorecard
+ARG scorecardversion=v5.1.1
 RUN <<EORUN
 set -xeuo pipefail
 arch=$(arch)
@@ -56,9 +58,26 @@
 else
   echo bcvk unavailable for $arch
 fi
+
+# scorecard (OpenSSF security scanner)
+td=$(mktemp -d)
+(
+  cd $td
+  # Map arch to scorecard naming convention
+  case "${arch}" in
+    x86_64) scarch=amd64 ;;
+    aarch64) scarch=arm64 ;;
+    *) echo "scorecard unavailable for $arch"; exit 0 ;;
+  esac
+  target=scorecard_${scorecardversion#v}_linux_${scarch}.tar.gz
+  /bin/time -f '%E %C' curl -fLO https://github.com/ossf/scorecard/releases/download/$scorecardversion/$target
+  tar xvzf $target
+  mv scorecard /usr/local/bin/scorecard
+)
+rm -rf $td
 EORUN
 
 FROM base as rust
 RUN <<EORUN
 set -xeuo pipefail
 # Setup rust; the idea here though is we install system-wide into /usr/local

renovate-shared-config.json

@@ -39,6 +39,14 @@
       "matchStrings": [
         "# renovate: datasource=(?<datasource>[a-z-]+) depName=(?<depName>[^\\s]+)\\n.*@(?<currentValue>\\S+)"
       ]
+    },
+    // Shell scripts in GHA workflows/actions: Match "# renovate:" followed by VERSION=
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["**/*.yml", "**/*.yaml"],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>[a-z-]+) depName=(?<depName>[^\\s]+)\\n\\s*VERSION=(?<currentValue>v?\\S+)"
+      ]
     }
   ],
   "packageRules": [