mirror of
https://github.com/fleetdm/fleet
synced 2026-05-22 16:39:01 +00:00
18256bdf0e
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Upgraded security protections across build and deployment workflows
for enhanced runner environment hardening.
* Strengthened CI/CD infrastructure security measures throughout
automated processes.
* No direct user-facing changes.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
75 lines
2.6 KiB
YAML
75 lines
2.6 KiB
YAML
name: OSSF Scorecard
|
|
on:
|
|
# For Branch-Protection check. Only the default branch is supported. See
|
|
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
|
|
branch_protection_rule:
|
|
# To guarantee Maintained check is occasionally updated. See
|
|
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
|
|
schedule:
|
|
- cron: '20 0 * * 1'
|
|
push:
|
|
branches: [ "main" ]
|
|
|
|
# Declare default permissions as read only.
|
|
permissions: read-all
|
|
|
|
jobs:
|
|
gradle-wrapper-validation:
|
|
name: Validate Gradle wrapper
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: "Checkout code"
|
|
uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Validate Gradle wrapper
|
|
# Needed for OSSF Scorecard to OK our gradle-wrapper.jar binary.
|
|
uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
|
|
|
|
analysis:
|
|
name: Scorecard analysis
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
# Needed to upload the results to code-scanning dashboard.
|
|
security-events: write
|
|
# Needed to publish results and get a badge (see publish_results below).
|
|
id-token: write
|
|
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: "Checkout code"
|
|
uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: "Run analysis"
|
|
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
|
|
with:
|
|
results_file: results.sarif
|
|
results_format: sarif
|
|
publish_results: true
|
|
|
|
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
|
|
# format to the repository Actions tab.
|
|
- name: "Upload artifact"
|
|
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
|
|
with:
|
|
name: SARIF file
|
|
path: results.sarif
|
|
retention-days: 5
|
|
|
|
# Upload the results to GitHub's code scanning dashboard.
|
|
- name: "Upload to code-scanning"
|
|
uses: github/codeql-action/upload-sarif@f6e388ebf0efc915c6c5b165b019ee61a6746a38 # v2.20.1
|
|
with:
|
|
sarif_file: results.sarif
|