Improvement of OpenSSF Scorecard Score

[harshitasao]

Hi, I'm Harshita. I’m working with CNCF and the Google Open Source Security Team for the GSoC 2024 term. We are collaborating to enhance security practices across various CNCF projects. The goal is to improve security for all CNCF projects by both using OpenSSF Scorecards and implementing its security improvements.

After the opening of the scorecard action addition PR, I'm here to increase the final score by going over each check. I've listed all of the checks where work needs to be done, in order of its criticality. I plan to submit each PR for each fix. Please let me know what you think and for which ones a PR is welcome that I will submit it ASAP.

Current Score: 8.5

Scorecard report: https://scorecard.dev/viewer/?uri=github.com/crossplane/crossplane

Here's a few checks we can work on to improve the project's security posture [ in order of its criticality ]:

• Token-Permissions: Score = 0

  • The issue here is that many workflows doesn’t have a top-level read-only permissions block like present in the other workflows. Scorecard is quite severe in this check: a single workflow without top-level permissions gets a 0/10 for the check.
  • PR: fix: fixed the token-permission and pinned-dependencies #5891

• Pinned-Dependencies: Score = 7

  • Many github actions are not pinned by hash, which is resulting in a low score.
  • Pinning dependencies to a specific hash rather than allowing mutable versions or ranges of versions improves supply chain security.
  • PR: fix: fixed the token-permission and pinned-dependencies #5891

/cc @joycebrum @diogoteles08 @pnacht @nate-double-u

[github-actions]

Crossplane does not currently have enough maintainers to address every issue and pull request. This issue has been automatically marked as stale because it has had no activity in the last 90 days. It will be closed in 14 days if no further activity occurs. Leaving a comment starting with /fresh will mark this issue as not stale.

[phisco]

solved by #5891