Repository navigation
馃懛 ci: harden Scorecard-scored checks in CI - #3241
Merged
Merged
Conversation
The OpenSSF Scorecard added in pypa#3238 flagged missing top-level permissions on two workflows and no SAST tool matching its detection rules, since CodeQL default setup is invisible to it. Added permissions: {} to check.yaml and pre-release.yaml (release.yaml gets its own commit alongside the provenance work). Added an advanced CodeQL workflow for python and actions, next to default setup which gets disabled in repo settings. Annotated the embedded pip/setuptools wheels in scorecard.yml as remediated, since they carry sha256 verification but Scorecard has no way to see that.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The OpenSSF Scorecard workflow from #3238 put the project at 7.0 this week. Two checks lose points for reasons that cost little to fix.
Token-Permissionssits at 8 becausecheck.yamlandpre-release.yamllack a top-levelpermissions:block, something Scorecard flags even though every job in both files already scopes its own token.SASTsits at 3 for a different reason: this repo runs CodeQL through GitHub's default setup, but Scorecard's detection only looks for thegithub/codeql-action/analyzestep that an advanced workflow uses, so it does not see the existing scanning.Adding
permissions: {}to the top of both workflows changes the effective token for zero jobs, since job-level permissions already override it.codeql.yamlruns an advanced CodeQL scan forpythonandactionson push, pull request, and a weekly schedule, pinned to the samegithub/codeql-actioncommitscorecard.yamlalready uses. Turning this on means switching Code scanning from default setup to advanced in the repository settings, since GitHub only allows one at a time.One finding stays as-is.
Binary-Artifactsflags the four embedded pip and setuptools wheels, and virtualenv seeds every new environment from those wheels, so removing them is not an option.scorecard.ymlannotates that finding asremediated:tasks/upgrade_wheels.pyrecords and checks a sha256 for every bundled wheel, so the binaries carry verified integrity even though Scorecard cannot see it. The annotation documents that for anyone reading the report; it does not change the score.