chore: ossf-scorecard #10748
chore: ossf-scorecard #10748
Conversation
WalkthroughA new GitHub Actions workflow file has been added to automate OpenSSF Scorecard supply-chain security analysis. The workflow runs on specific triggers, executes the Scorecard action, and uploads results to both GitHub's code scanning dashboard and as an artifact, with options for further integration and reporting. Changes
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
View your CI Pipeline Execution ↗ for commit a8de217.
☁️ Nx Cloud last updated this comment at |
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/ossf-scorecard.yml (2)
21-30: Add concurrency to avoid overlapping runsWithout a concurrency group, multiple triggers (e.g., cron + push) can queue redundant Scorecard analyses. Consider cancelling in-flight runs when a new one starts.
concurrency: group: ossf-scorecard-${{ github.ref_name }} cancel-in-progress: true
17-19: Scope default permissions to the minimumGranting
read-allat the workflow level may be overly permissive. You can default to no permissions and explicitly opt into the required scopes at the job level.- permissions: read-all + permissions: {}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/ossf-scorecard.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: test-ios
- GitHub Check: test-android
- GitHub Check: Analyze (java-kotlin)
| # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled. | ||
| if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request' | ||
| permissions: |
There was a problem hiding this comment.
Fix the job-level filter to include scheduled and branch-protection runs
The current if only allows default-branch pushes or PRs, blocking both your cron and branch-protection triggers.
Apply this diff to also run on schedule and branch_protection_rule events:
- if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
+ if: >
+ github.event_name == 'schedule' ||
+ github.event_name == 'branch_protection_rule' ||
+ github.event.repository.default_branch == github.ref_name ||
+ github.event_name == 'pull_request'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled. | |
| if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request' | |
| permissions: | |
| # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled. | |
| if: > | |
| github.event_name == 'schedule' || | |
| github.event_name == 'branch_protection_rule' || | |
| github.event.repository.default_branch == github.ref_name || | |
| github.event_name == 'pull_request' | |
| permissions: |
🤖 Prompt for AI Agents
In .github/workflows/ossf-scorecard.yml around lines 24 to 26, the job-level
`if` condition currently only allows runs on default branch pushes or pull
requests, which blocks scheduled (cron) and branch protection rule events.
Update the `if` condition to also include `schedule` and
`branch_protection_rule` events by adding checks for these event names alongside
the existing conditions.
https://securityscorecards.dev
Summary by CodeRabbit