From b51e2339206920e6f183ddcf82de6a386bdce35d Mon Sep 17 00:00:00 2001 From: laurentsimon Date: Fri, 9 Dec 2022 16:57:59 +0000 Subject: [PATCH 1/5] update Signed-off-by: laurentsimon --- main.go | 7 +- .../properties/scorecards.properties.json | 10 --- .../code-scanning/scorecards.yml | 72 ------------------- 3 files changed, 6 insertions(+), 83 deletions(-) delete mode 100644 starter-workflows/code-scanning/properties/scorecards.properties.json delete mode 100644 starter-workflows/code-scanning/scorecards.yml diff --git a/main.go b/main.go index 4d1629a3..0e77d25d 100644 --- a/main.go +++ b/main.go @@ -24,6 +24,11 @@ import ( ) func main() { + triggerEventName := os.Getenv("GITHUB_EVENT_NAME") + if triggerEventName == "pull_request_target" { + log.Fatalf("pull_request_target trigger is not supported") + } + action, err := entrypoint.New() if err != nil { log.Fatalf("creating scorecard entrypoint: %v", err) @@ -35,7 +40,7 @@ func main() { if os.Getenv(options.EnvInputPublishResults) == "true" && // `pull_request` do not have the necessary `token-id: write` permissions. - os.Getenv("GITHUB_EVENT_NAME") != "pull_request" { + triggerEventName != "pull_request" { // Get json results by re-running scorecard. jsonPayload, err := signing.GetJSONScorecardResults() if err != nil { diff --git a/starter-workflows/code-scanning/properties/scorecards.properties.json b/starter-workflows/code-scanning/properties/scorecards.properties.json deleted file mode 100644 index 54362eb9..00000000 --- a/starter-workflows/code-scanning/properties/scorecards.properties.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "name": "OSSF Scorecards supply-chain security analysis", - "creator": "Open Source Security Foundation (OpenSSF) - https://github.com/ossf", - "description": "Scorecards is a static analysis tool to assess the security posture of your project", - "iconName": "scorecards", - "categories": [ - "code-quality", "testing", - "supply-chain", "security", "scanning" - ] -} diff --git a/starter-workflows/code-scanning/scorecards.yml b/starter-workflows/code-scanning/scorecards.yml deleted file mode 100644 index d6a6f1ed..00000000 --- a/starter-workflows/code-scanning/scorecards.yml +++ /dev/null @@ -1,72 +0,0 @@ -# Copyright 2022 OpenSSF Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# SPDX-License-Identifier: Apache-2.0 - -name: Scorecards supply-chain security -on: - # Only the default branch is supported. - branch_protection_rule: - schedule: - - cron: $cron-weekly - push: - branches: [ $default-branch ] - -# Declare default permissions as read only. -permissions: read-all - -jobs: - analysis: - name: Scorecards analysis - runs-on: ubuntu-latest - permissions: - # Needed to upload the results to code-scanning dashboard. - security-events: write - actions: read - contents: read - - steps: - - name: "Checkout code" - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # v3.0.0 - with: - persist-credentials: false - - - name: "Run analysis" - uses: ossf/scorecard-action@c1aec4ac820532bab364f02a81873c555a0ba3a1 # v1.0.4 - with: - results_file: results.sarif - results_format: sarif - # Read-only PAT token. To create it, - # follow the steps in https://github.com/ossf/scorecard-action#pat-token-creation. - repo_token: ${{ secrets.SCORECARD_READ_TOKEN }} - # Publish the results to enable scorecard badges. For more details, see - # https://github.com/ossf/scorecard-action#publishing-results. - # For private repositories, `publish_results` will automatically be set to `false`, - # regardless of the value entered here. - publish_results: true - - # Upload the results as artifacts (optional). - - name: "Upload artifact" - uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v3.0.0 - with: - name: SARIF file - path: results.sarif - retention-days: 5 - - # Upload the results to GitHub's code scanning dashboard. - - name: "Upload to code-scanning" - if: ${{ github.event_name != 'pull_request' }} - uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # v1.0.26 - with: - sarif_file: results.sarif From 2b64b0f47a7f444fc0ee7b7ca8eadb03703d2891 Mon Sep 17 00:00:00 2001 From: laurentsimon Date: Fri, 9 Dec 2022 19:08:57 +0000 Subject: [PATCH 2/5] update Signed-off-by: laurentsimon --- main.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main.go b/main.go index 0e77d25d..10f43988 100644 --- a/main.go +++ b/main.go @@ -26,7 +26,7 @@ import ( func main() { triggerEventName := os.Getenv("GITHUB_EVENT_NAME") if triggerEventName == "pull_request_target" { - log.Fatalf("pull_request_target trigger is not supported") + log.Fatalf("pull_request_target trigger is not supported for security reasons - see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/") } action, err := entrypoint.New() From 898571e4cc0b68b35a3cc4dc0c7b7b2b04fad1bd Mon Sep 17 00:00:00 2001 From: laurentsimon Date: Fri, 9 Dec 2022 20:17:39 +0000 Subject: [PATCH 3/5] update Signed-off-by: laurentsimon --- main.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/main.go b/main.go index 10f43988..c15219e5 100644 --- a/main.go +++ b/main.go @@ -26,7 +26,8 @@ import ( func main() { triggerEventName := os.Getenv("GITHUB_EVENT_NAME") if triggerEventName == "pull_request_target" { - log.Fatalf("pull_request_target trigger is not supported for security reasons - see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/") + log.Fatalf("pull_request_target trigger is not supported for security reasons" + + "see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/") } action, err := entrypoint.New() From 5824c94e37ab527c813c59afffef9040b51d49b9 Mon Sep 17 00:00:00 2001 From: laurentsimon Date: Fri, 9 Dec 2022 20:20:06 +0000 Subject: [PATCH 4/5] update Signed-off-by: laurentsimon --- main.go | 1 - 1 file changed, 1 deletion(-) diff --git a/main.go b/main.go index c15219e5..4b0a9879 100644 --- a/main.go +++ b/main.go @@ -29,7 +29,6 @@ func main() { log.Fatalf("pull_request_target trigger is not supported for security reasons" + "see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/") } - action, err := entrypoint.New() if err != nil { log.Fatalf("creating scorecard entrypoint: %v", err) From ed33b79c5fcf8b2247f2076a825e2622c5faa578 Mon Sep 17 00:00:00 2001 From: laurentsimon Date: Fri, 9 Dec 2022 20:20:33 +0000 Subject: [PATCH 5/5] update Signed-off-by: laurentsimon --- main.go | 1 + 1 file changed, 1 insertion(+) diff --git a/main.go b/main.go index 4b0a9879..c15219e5 100644 --- a/main.go +++ b/main.go @@ -29,6 +29,7 @@ func main() { log.Fatalf("pull_request_target trigger is not supported for security reasons" + "see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/") } + action, err := entrypoint.New() if err != nil { log.Fatalf("creating scorecard entrypoint: %v", err)