From b090bfcb1f8d1e99be09d1557dac497b2535d6c8 Mon Sep 17 00:00:00 2001 From: Sebastian Legarraga <64795732+slegarraga@users.noreply.github.com> Date: Fri, 7 Aug 2026 09:53:57 -0400 Subject: [PATCH 1/2] feat: add OSPS baseline maturity config Signed-off-by: Sebastian Legarraga <64795732+slegarraga@users.noreply.github.com> --- .github/workflows/baseline-scanner.yml | 48 +++++++++++++++ security-insights.yml | 83 ++++++++++++++++++++++++++ 2 files changed, 131 insertions(+) create mode 100644 .github/workflows/baseline-scanner.yml create mode 100644 security-insights.yml diff --git a/.github/workflows/baseline-scanner.yml b/.github/workflows/baseline-scanner.yml new file mode 100644 index 0000000..7a11374 --- /dev/null +++ b/.github/workflows/baseline-scanner.yml @@ -0,0 +1,48 @@ +name: OSPS Baseline Scanner + +on: + schedule: + # Run weekly on Mondays at 9 AM UTC + - cron: "0 9 * * 1" + workflow_dispatch: # Allow manual triggering + +jobs: + osps-assessment: + runs-on: ubuntu-latest + name: Baseline Scan + + permissions: + contents: read + security-events: write # Required for SARIF upload + + steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Generate GitHub App token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + id: app-token + with: + client-id: ${{ secrets.GEMARA_AUTOMATION_CLIENT_ID }} + private-key: ${{ secrets.GEMARA_AUTOMATION_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} + repositories: ${{ github.repository }} + permission-contents: read + permission-administration: read + + - name: Run Baseline Action + uses: revanite-io/osps-baseline-action@ace75cc1fb748be898275f16f59f78363405bc0a # v1.3.3 + with: + owner: ${{ github.repository_owner }} + repo: ${{ github.event.repository.name }} + token: ${{ steps.app-token.outputs.token }} + catalog: "osps-baseline-2026-02" + upload-sarif: "true" + + - name: Upload Assessment Results + if: always() + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: osps-assessment-results-${{ github.run_number }} + path: evaluation_results/ + retention-days: 30 diff --git a/security-insights.yml b/security-insights.yml new file mode 100644 index 0000000..68d6d5f --- /dev/null +++ b/security-insights.yml @@ -0,0 +1,83 @@ +header: + schema-version: 2.0.0 + last-updated: '2026-08-07' + last-reviewed: '2026-08-07' + url: https://github.com/gemaraproj/gemara-react + project-si-source: https://raw.githubusercontent.com/gemaraproj/.github/refs/heads/main/.github/security-insights.yml + +repository: + url: https://github.com/gemaraproj/gemara-react + status: active + accepts-change-request: true + accepts-automated-change-request: true + core-team: + - name: Eddie Knight + affiliation: Sonatype + email: knight@linux.com + primary: false + - name: Jenn Power + affiliation: Red Hat + email: barnabei.jennifer@gmail.com + primary: true + - name: Jason Meridth + affiliation: GitHub + email: jmeridth@gmail.com + primary: false + - name: Travis Truman + affiliation: Independent + email: trumant@gmail.com + primary: false + - name: Alex Speasmaker + affiliation: USAA + email: alex.speasmaker@gmail.com + primary: false + documentation: + contributing-guide: https://github.com/gemaraproj/gemara-react/blob/main/README.md + license: + url: https://github.com/gemaraproj/gemara-react?tab=Apache-2.0-1-ov-file#readme + expression: Apache-2.0 + security: + assessments: + self: + comment: | + Self assessment has not yet been completed. + tools: + - name: Dependabot + type: SCA + version: "2" + rulesets: + - built-in + results: + adhoc: + name: Scheduled SCA Scan Results + predicate-uri: https://docs.github.com/en/graphql/reference/objects#repositoryvulnerabilityalert + location: https://github.com/gemaraproj/gemara-react/security/dependabot + comment: | + The results of the scheduled SCA scan are available in the Dependabot tab of the Security Insights page. + integration: + adhoc: true + ci: false + release: false + - name: CodeQL + type: SAST + version: "2.y.z" + rulesets: + - go + - actions + results: + adhoc: + name: Scheduled SAST Results + predicate-uri: https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/schemas/sarif-schema-2.1.0.json + location: https://github.com/gemaraproj/gemara-react/security/code-scanning + comment: | + The results of the scheduled SAST scan are available in the Code Scanning tab of the Security Insights page and as an artifact on the scheduled job. + ci: + name: CI SAST Results + predicate-uri: https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/schemas/sarif-schema-2.1.0.json + location: https://github.com/gemaraproj/gemara-react/security/code-scanning + comment: | + The results of the CI SAST scan are available in the Code Scanning tab of the Security Insights page. + integration: + adhoc: true + ci: true + release: false From f7ee67c8f5e8487d0db7f46362324bf97c38f9a1 Mon Sep 17 00:00:00 2001 From: slegarraga Date: Fri, 21 Aug 2026 18:38:15 -0400 Subject: [PATCH 2/2] chore: enable Dependabot so the security-insights claim is true The security-insights.yml Dependabot entry described a tool this repository did not have enabled (vulnerability-alerts endpoint returns 404 and no .github/dependabot.yml existed). Add the config for npm + github-actions on a weekly schedule so the claim matches reality, and refresh the review dates. Signed-off-by: slegarraga --- .github/dependabot.yml | 10 ++++++++++ security-insights.yml | 4 ++-- 2 files changed, 12 insertions(+), 2 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..5a32bd8 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,10 @@ +version: 2 +updates: + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly diff --git a/security-insights.yml b/security-insights.yml index 68d6d5f..078e415 100644 --- a/security-insights.yml +++ b/security-insights.yml @@ -1,7 +1,7 @@ header: schema-version: 2.0.0 - last-updated: '2026-08-07' - last-reviewed: '2026-08-07' + last-updated: '2026-08-21' + last-reviewed: '2026-08-21' url: https://github.com/gemaraproj/gemara-react project-si-source: https://raw.githubusercontent.com/gemaraproj/.github/refs/heads/main/.github/security-insights.yml