Repository navigation
Harden supply chain: pin actions, Dependabot, CodeQL workflow, property tests - #94
Merged
Merged
Conversation
…ty tests Driven by the OpenSSF Scorecard results (4.6/10): - Token-Permissions (0): release.yml had no top-level permissions block, so every job without its own grant ran with full write access. Default to contents: read; the release and GHCR jobs keep their scoped writes. - Pinned-Dependencies (1): every action in ci.yml and release.yml is now pinned to a commit SHA with the version in a comment, and the Docker base image to its digest. 13 GitHub-owned and 3 third-party actions were floating on major tags. - Dependency-Update-Tool (0): .github/dependabot.yml for github-actions, pip, docker and npm, weekly and grouped per ecosystem. - SAST (4): CodeQL default setup scanned PRs only, leaving 18 of the last 30 commits unchecked. codeql.yml runs on push to main, PRs and weekly for python, javascript-typescript and actions. - Fuzzing (0): Hypothesis property tests for the severity/risk-rating report parsers, skill frontmatter parsing and severity normalisation, covering round-trips and never-raises-on-garbage. - Branch-Protection: CODEOWNERS so code-owner review can be required once a second owner is listed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Driven by the OpenSSF Scorecard results (4.6/10). Each item maps to a check.
release.ymlhad no top-levelpermissions:, so jobs without their own grant ran with full write. Nowcontents: readby default; the release and GHCR jobs keep their scoped writes.ci.yml/release.ymlpinned to commit SHAs (version in a comment); Docker base image pinned to its digest..github/dependabot.yml: github-actions, pip, docker, npm; weekly, grouped per ecosystem. Keeps the SHAs above fresh.codeql.ymlruns on push tomain, PRs and weekly. Default setup has been disabled on the repo so the two don't conflict.tests/test_property_parsers.py) for the report severity/risk-rating parsers, skill frontmatter parsing and severity normalisation. Scorecard recognises property-based testing for Python.CODEOWNERS(@vsn411). The ruleset changes themselves (1 required approval, up-to-date branches, last-push approval) are repo settings, applied after this merges.Not in this PR, on purpose: hashed pip lockfiles (
--require-hashes) for the fourpip installcommands. That would take Pinned-Dependencies from ~7 to 10 but adds a lockfile to regenerate on every dependency change.Made with Cursor