security: OpenSSF Scorecard hardening — Stage 1 + Pinned-Dependencies (proposal)#13
Open
cliffcolvin wants to merge 4 commits into
Open
security: OpenSSF Scorecard hardening — Stage 1 + Pinned-Dependencies (proposal)#13cliffcolvin wants to merge 4 commits into
cliffcolvin wants to merge 4 commits into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR proposes Stage 1 OpenSSF Scorecard hardening by adding baseline security hygiene artifacts (Dependabot + SECURITY.md) and tightening GitHub Actions default token permissions to least-privilege.
Changes:
- Add
.github/dependabot.ymlfor weekly updates ofgithub-actionsandgomoddependencies. - Add a repository
SECURITY.mddescribing supported versions, reporting flow, and disclosure process. - Reduce default workflow token permissions in
update-go-version.yaml, scoping write permissions to the job.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| SECURITY.md | Adds a security policy with reporting and disclosure guidance. |
| .github/workflows/update-go-version.yaml | Lowers default token permissions and scopes write permissions to the update job. |
| .github/dependabot.yml | Configures weekly Dependabot updates for Actions and Go modules. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+7
to
+9
| labels: | ||
| - "dependencies" | ||
| - "github-actions" |
Comment on lines
+15
to
+17
| labels: | ||
| - "dependencies" | ||
| - "go" |
Address three low-risk, additive Scorecard findings: - Dependency-Update-Tool: add .github/dependabot.yml covering the github-actions and gomod ecosystems (weekly). Also keeps pinned action SHAs current for later hardening stages. - Security-Policy: add SECURITY.md with a private vulnerability reporting contact, disclosure policy, and supported-versions info. - Token-Permissions: update-go-version.yaml declared top-level contents: write. Scope it to read at the top level and move contents/pull-requests: write down to the job that commits and opens the PR. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Cliff Colvin <clifford.colvin@ibm.com>
Match the OpenCost org's dependabot style (commented sections, no custom labels). Single gomod directory since bingen is a single module, plus the github-actions ecosystem. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Cliff Colvin <clifford.colvin@ibm.com>
cliffcolvin
force-pushed
the
stage1/openssf-scorecard-hardening
branch
from
f261a82 to
b25dbc3
Compare
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Cliff Colvin <clifford.colvin@ibm.com>
Scorecard Pinned-Dependencies (Stage 2a). Pin every unpinned `uses:` reference to a full-length commit SHA, keeping the human-readable version tag in a trailing comment. Covers build-test, codecs-check, codeql, format-check, golangci-lint, scorecard, sonar, update-go-version, and vulnerability-scan. The Dependabot github-actions config added in this branch keeps these SHAs current so pinning does not rot. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Cliff Colvin <clifford.colvin@ibm.com>
cliffcolvin
changed the title
|
|
||
| ## Code Security | ||
|
|
||
| Application code is version controlled using GitHub. All code changes are tracked with full revision history and are attributable to a specific individual. Code must be reviewed and accepted by a different engineer than the author of the change. |
|
|
||
| Please include a thorough description of the issue, the steps you took to reproduce it, affected versions, and, if known, any mitigations. The maintainers will help diagnose the severity of the issue and determine how to address it. We aim to acknowledge new reports within 3 business days. Issues deemed to be non-critical will be filed as GitHub issues. Critical issues will receive immediate attention and be fixed as quickly as possible. | ||
|
|
||
| ## Disclosure policy |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposal: OpenSSF Scorecard hardening
Opening this as a proposal for discussion. It targets the cheapest, highest-value Scorecard findings — all additive and low-risk. Config/policy wins (Stage 1) plus Actions SHA-pinning (Stage 2a).
Stage 1 — file/config wins
1. Dependency-Update-Tool (0 → 10) — add
.github/dependabot.ymlcovering thegomodandgithub-actionsecosystems on a weekly cadence. Best effort-to-points trade in the plan, and it doubles as the maintenance engine that keeps pinned action SHAs current (see Stage 2a). Styled to match the OpenCost org's own dependabot config.2. Security-Policy (0 → 10) — add a root
SECURITY.md. It provides a private vulnerability reporting contact, a supported-versions statement, and an explicit disclosure policy. Structure is adapted from the OpenCost org policy, trimmed to what applies to bingen (no container image signing here).3. Token-Permissions (0 → 10) —
update-go-version.yamlset top-levelcontents: write, which is why this check scored 0 while every other workflow is already read-scoped. This sets the top level tocontents: readand movescontents: write+pull-requests: writedown to the single job that commits the bump and opens the PR.Stage 2a — Pinned-Dependencies (3 → ~10)
Pin every unpinned
uses:reference to a full-length commit SHA, keeping the human-readable version tag in a trailing comment. Go module deps already count as pinned, so this is purely the Actions.Actions pinned in this PR:
actions/checkout,actions/setup-go,actions/cache,actions/upload-artifact,actions/download-artifact,github/codeql-action/{init,autobuild,analyze,upload-sarif},golangci/golangci-lint-action,peter-evans/create-pull-request. (ossf/scorecard-action,SonarSource/sonarqube-scan-action, andaquasecurity/trivy-actionwere already SHA-pinned.)Files touched:
build-test.yaml,codecs-check.yaml,codeql.yaml,format-check.yaml,golangci-lint.yaml,scorecard.yml,sonar.yaml,update-go-version.yaml,vulnerability-scan.yaml. The Dependabotgithub-actionsconfig from Stage 1 keeps these SHAs from going stale.🤖 Generated with Claude Code