feat(ci): OpenSSF Scorecard analysis with published results - #42
Conversation
Weekly + on-main-push Scorecard runs (official ossf workflow shape: read-all default, job-scoped security-events/id-token writes, only allowlisted actions in the job, all SHA-pinned). Results publish to the Scorecard API (badge) and the repo code-scanning dashboard. README gains Scorecard, CI, release, and Go Report Card badges.
Sol review: the checkout SHA is v7.0.1 (Dependabot bump) but comments still said v6, hiding a major-version change from reviewers. Fixed in all workflows.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
💤 Files with no reviewable changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe pull request updates pinned ChangesCI and security updates
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant Workflow
participant Repository
participant Scorecard
participant CodeScanning
Workflow->>Repository: checkout source
Workflow->>Scorecard: analyze repository and write results.sarif
Workflow->>CodeScanning: upload SARIF results
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/action-smoke.yml (1)
23-23: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDisable unnecessary checkout credential persistence in read-only jobs.
These jobs do not need authenticated Git operations. Set
persist-credentials: falseat every affected checkout step to reduce token exposure; retain persistence only where a later authenticated operation, such as the tag push in.github/workflows/release.yml, requires it. (github.com)
.github/workflows/action-smoke.yml#L23-L23: addwith.persist-credentials: false..github/workflows/action-smoke.yml#L46-L46: addwith.persist-credentials: false..github/workflows/action-smoke.yml#L69-L69: addwith.persist-credentials: false..github/workflows/action-smoke.yml#L160-L160: addwith.persist-credentials: false..github/workflows/action-live-signoff.yml#L19-L19: addwith.persist-credentials: false.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/action-smoke.yml at line 23, Disable checkout credential persistence at all five affected steps: add with.persist-credentials: false to the checkout steps at .github/workflows/action-smoke.yml lines 23, 46, 69, and 160, and .github/workflows/action-live-signoff.yml line 19. Do not alter checkout persistence for workflows requiring authenticated operations.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/scorecard.yml:
- Around line 16-18: Update the job-level permissions block in the Scorecard
workflow to include contents: read alongside security-events and id-token,
preserving the existing permissions so checkout and Scorecard retain the
required repository access.
In `@README.md`:
- Line 6: Remove the Go Report Card badge and its link from the README.md badges
section; do not replace it unless an existing active Go quality-checking
pipeline is already available.
---
Nitpick comments:
In @.github/workflows/action-smoke.yml:
- Line 23: Disable checkout credential persistence at all five affected steps:
add with.persist-credentials: false to the checkout steps at
.github/workflows/action-smoke.yml lines 23, 46, 69, and 160, and
.github/workflows/action-live-signoff.yml line 19. Do not alter checkout
persistence for workflows requiring authenticated operations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 8d981dfd-6710-472e-8877-d0d106d36c23
📒 Files selected for processing (6)
.github/workflows/action-live-signoff.yml.github/workflows/action-smoke.yml.github/workflows/ci.yml.github/workflows/release.yml.github/workflows/scorecard.ymlREADME.md
…adge CodeRabbit review: job-level permissions replace top-level read-all, so contents was none - checkout needs it explicitly. goreportcard.com is discontinued (verified unreachable); badge removed.
|
@coderabbitai review |
✅ Action performedReview finished.
|
1 participant
Summary
Batch H PR 2 — OpenSSF Scorecard, done after H5 (secret scanning, push protection, Dependabot security updates were enabled first per Sol architect's ordering, so the first badge reflects the real posture).
scorecard.yml: mirrors the officialossf/scorecardreference workflow —permissions: read-allat top, job-scopedsecurity-events: write+id-token: write, only allowlisted actions in the job (checkout / scorecard-action / upload-artifact / upload-sarif), all SHA-pinned, weekly cron + on-main-push.publish_results: truefeeds the badge, the public Scorecard API, and the repo's code-scanning dashboard. Docs-first: workflow-restriction rules and the reference workflow were fetched from the current ossf sources, not trained memory.# v6while the Dependabot-bumped SHA is actually v7.0.1 — misleading annotation corrected everywhere (the contract tests assert SHA-pinning itself, so this is comment-only).Sol secops verdict: NEEDS-CHANGES on the annotation only → fixed; all other checks OK (publish-restriction compliance, pin validity, badge URLs, no confidentiality delta for a public repo).
Real-environment validation plan (post-merge)
The scorecard job triggers on the merge push to main — I'll watch that run live, confirm SARIF lands in code-scanning and the badge endpoint returns a score.
Summary by CodeRabbit
New Features
Documentation
Chores