Repository navigation
Delete ephapax-proven-ffi/.machine_readable/6a2 directory #431
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| # Prevention workflow - runs OpenSSF Scorecard and fails on low scores. | |
| # | |
| # Split into TWO jobs to satisfy the OSSF Scorecard webapp's workflow | |
| # restriction: | |
| # "scorecard job must only have steps with `uses`" | |
| # (https://github.com/ossf/scorecard-action#workflow-restrictions). | |
| # | |
| # When the publishing job contains a `run:` step, the webapp rejects | |
| # the signed-result POST with HTTP 400 "workflow verification failed". | |
| # That regression had this workflow `failure`-state ever since | |
| # `publish_results: true` was added — the score *was* computed, but | |
| # the webapp publish step failed and propagated to job-level failure. | |
| # | |
| # Job 1 (`scorecard`): uses-only steps. Computes the score, publishes | |
| # signed results to the OSSF webapp, uploads SARIF to GitHub code | |
| # scanning, and saves results.json as an artifact for Job 2. | |
| # | |
| # Job 2 (`enforce-min-score`): downloads the artifact and runs the | |
| # minimum-score gate. May contain `run:` steps freely — it does not | |
| # call scorecard-action. | |
| name: OpenSSF Scorecard Enforcer | |
| on: | |
| push: | |
| branches: [main] | |
| schedule: | |
| - cron: '0 6 * * 1' # Weekly on Monday | |
| workflow_dispatch: | |
| # Estate guardrail: cancel superseded runs so re-pushes / rebased PR | |
| # updates do not pile up queued runs against the shared account-wide | |
| # Actions concurrency pool. Applied only to read-only check workflows | |
| # (no publish/mutation), so cancelling a superseded run is always safe. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| scorecard: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| security-events: write | |
| id-token: write # For OIDC | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false | |
| - name: Run Scorecard | |
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - name: Upload SARIF | |
| uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 | |
| with: | |
| sarif_file: results.sarif | |
| - name: Upload results artifact for min-score gate | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: scorecard-results | |
| path: results.sarif | |
| retention-days: 7 | |
| enforce-min-score: | |
| needs: scorecard | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Download results artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: scorecard-results | |
| - name: Check minimum score | |
| run: | | |
| # Parse score from SARIF results. | |
| SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0") | |
| echo "OpenSSF Scorecard Score: $SCORE" | |
| # Minimum acceptable score (0-10 scale). | |
| MIN_SCORE=5 | |
| if [ "$(echo "$SCORE < $MIN_SCORE" | bc -l)" = "1" ]; then | |
| echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE" | |
| exit 1 | |
| fi | |
| # Check specific high-priority items | |
| check-critical: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - name: Check SECURITY.md exists | |
| run: | | |
| if [ ! -f "SECURITY.md" ]; then | |
| echo "::error::SECURITY.md is required" | |
| exit 1 | |
| fi | |
| - name: Check for pinned dependencies | |
| run: | | |
| # Check workflows for unpinned actions | |
| unpinned=$(grep -r "uses:.*@v[0-9]" .github/workflows/*.yml 2>/dev/null | grep -v "#" | head -5 || true) | |
| if [ -n "$unpinned" ]; then | |
| echo "::warning::Found unpinned actions:" | |
| echo "$unpinned" | |
| fi |