Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for OSSF scorecard reporting #5431

Merged
merged 1 commit into from
Jan 15, 2025
Merged

Add support for OSSF scorecard reporting #5431

merged 1 commit into from
Jan 15, 2025

Conversation

UlisesGascon
Copy link
Member

Main Changes

This pipeline will proactively report the status of the project (every day and when a push is done to master branch) including critical fields (CI-Tests, Contributors, Dependency-Update-Tool, Webhooks) that are missing while running via OSSF cron jobs.

Context

Changes related

It's also possible that some repositories in your organization are already being automatically tracked by OpenSSF in this CSV file via weekly cronjob. One caveat: Automatically tracked projects do not include ossf/scorecard#3438 in their analysis (CI-Tests,Contributors,Dependency-Update-Tool,Webhooks).
Source: openssf-scorecard-monitor documentation

Team discussion related

Changelog

@UlisesGascon UlisesGascon marked this pull request as ready for review February 2, 2024 15:44
@UlisesGascon UlisesGascon mentioned this pull request Feb 22, 2024
Open
inigomarquinez
inigomarquinez approved these changes Mar 17, 2024
View reviewed changes
Copy link
Member

@inigomarquinez inigomarquinez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@UlisesGascon UlisesGascon mentioned this pull request Apr 16, 2024
Open
@UlisesGascon UlisesGascon added the semver-ignore This change does not have any impact in semver (docs, tooling, etc..) label Apr 17, 2024
@bjohansebas
Copy link
Member

I think it's the only repository where the scorecard integration is missing

@UlisesGascon
Copy link
Member Author

One more approval from the TC team and I can merge it 👍

wesleytodd
wesleytodd approved these changes Jan 14, 2025
View reviewed changes
Copy link
Member

@wesleytodd wesleytodd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was this just pending another approval? Since it has sat for a bit we should just double check it has not suffered from bit rot, but 👍 in general.

bjohansebas
bjohansebas suggested changes Jan 14, 2025
View reviewed changes
Copy link
Member

@bjohansebas bjohansebas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since it hasn't been merged yet, the actions can be updated as done in jshttp/accepts#40

@UlisesGascon UlisesGascon merged commit ff86319 into expressjs:master Jan 15, 2025
24 checks passed
@UlisesGascon UlisesGascon deleted the tools/ossf-scorecard branch January 15, 2025 06:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bjohansebas bjohansebas bjohansebas requested changes

@inigomarquinez inigomarquinez inigomarquinez approved these changes

@wesleytodd wesleytodd wesleytodd approved these changes

@ctcpip ctcpip Awaiting requested review from ctcpip

Assignees
No one assigned
Labels
semver-ignore This change does not have any impact in semver (docs, tooling, etc..)
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@UlisesGascon @bjohansebas @wesleytodd @inigomarquinez