Add scorecards config by laurentsimon · Pull Request #1302 · actions/starter-workflows

laurentsimon · 2021-12-10T17:53:48Z

Pre-requisites

Prior to submitting a new workflow, please apply to join the GitHub Technology Partner Program: partner.github.com/apply.

cc @josepalafox

Tasks

For all workflows, the workflow:

Should be contained in a .yml file with the language or platform as its filename, in lower, kebab-cased format (for example, docker-image.yml). Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").
Should use sentence case for the names of workflows and steps (for example, "Run tests").
Should be named only by the name of the language or platform (for example, "Go", not "Go CI" or "Go Build").
Should include comments in the workflow for any parts that are not obvious or could use clarification.

For Code Scanning workflows, the workflow:

Should be preserved under the code-scanning directory.

not sure what this means.

Should include a matching code-scanning/properties/*.properties.json file (for example, code-scanning/properties/codeql.properties.json), with properties set as follows:
- name: Name of the Code Scanning integration.
- organization: Name of the organization producing the Code Scanning integration.
- description: Short description of the Code Scanning integration.
- categories: Array of languages supported by the Code Scanning integration.
- iconName: Name of the SVG logo representing the Code Scanning integration. This SVG logo must be present in the icons directory.

cc @josepalafox is working on this.

Should run on push to branches: [ $default-branch, $protected-branches ] and pull_request to branches: [ $default-branch ]. We also recommend a schedule trigger of cron: $cron-weekly (for example, codeql.yml).

Some general notes:

This workflow must only use actions that are produced by GitHub, in the actions organization, or
This workflow must only use actions that are produced by the language or ecosystem that the workflow supports. These actions must be published to the GitHub Marketplace. We require that these actions be referenced using the full 40 character hash of the action's commit instead of a tag. Additionally, workflows must include the following comment at the top of the workflow file:
```
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
```
Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies.

There is a disclaimer, as suggested offline with @josepalafox

Automation and CI workflows cannot be dependent on a paid service or product.

closes ossf/scorecard-action#24
closes ossf/scorecard#1105

laurentsimon · 2021-12-16T15:56:05Z

friendly ping. Can you provide feedback or suggestions?

nickfyson

Thanks for this PR and apologies for the delay!

A few points/queries, but the main one if that we'll need a suitable SVG icon to use as the logo for the UI tile on the setup page. 🙂

laurentsimon · 2021-12-16T17:31:48Z

cc @olivekl

nickfyson

I made some suggested changes to the metadata wording, and with those applied this is how the tile looks..

The logo isn't ideal in this setting, but I think it could be okay...? 😀

laurentsimon · 2021-12-22T18:47:01Z

I made some suggested changes to the metadata wording, and with those applied this is how the tile looks..

The logo isn't ideal in this setting, but I think it could be okay...? 😀

Thank you @nickfyson for the update on the text, it looks better! I agree it'd look better with a tighter rounding box. Is this something we should do ourselves or you have some expertise to help with that?

nickfyson · 2021-12-22T21:01:07Z

@laurentsimon I'm afraid not, I think getting a more suitable output would be most easily done from whatever source exported the current SVG! 😕

laurentsimon · 2021-12-23T21:53:35Z

@laurentsimon I'm afraid not, I think getting a more suitable output would be most easily done from whatever source exported the current SVG! 😕

thanks. I'll wait till @josepalafox is back because I think he's working on it, and I'd like to avoid duplicating the work.

josepalafox · 2021-12-23T22:37:43Z

I am not. Sounds like we need help from marketing at OSSF. The logo is a little small but it looks ok to launch with imho.

laurentsimon · 2021-12-28T19:13:07Z

I am not. Sounds like we need help from marketing at OSSF. The logo is a little small but it looks ok to launch with imho.

@inferno-chromium whom can I talk to to tweak the logo?

inferno-chromium · 2021-12-29T17:20:44Z

I am not. Sounds like we need help from marketing at OSSF. The logo is a little small but it looks ok to launch with imho.

@inferno-chromium whom can I talk to to tweak the logo?

Original designer at 99Designs left. We would have to create another contract with 99Designs to create a new logo for this specific usecase. Jenn (jbonner@) at LF can help with contract on this.

laurentsimon · 2022-01-04T19:14:00Z

one question I have is where will users see the template workflow from this workflow. I looked at https://github.com/marketplace/actions/anchore-container-scan which is defined in the starter-workflows, but when I click "use latest version" it only shows uses: ... not the entire workflow template in this repo.
I was expecting that clicking the button would start a new pull request on a repo of my choice with the content of the workflow template from this repo.

nickfyson

🚀

josepalafox · 2022-01-04T19:16:04Z

Unfortunately Stater workflows and Marketplace are two separate entities right now. The Marketplace entry is the generic action that just runs that scanner, usually we ask partners to embed the additional workflow in the description there. The stater-workflow will be accessible through the GH.com UI in the actions tab.

…

On Tue, Jan 4, 2022 at 11:14 AM laurentsimon ***@***.***> wrote: one question I have is where will users be prompted with this workflow. I looked at https://github.com/marketplace/actions/anchore-container-scan which is defined in the starter-workflows, but when I click "use latest version" it only shows uses: ... not the entire workflow template in this repo. I was expecting that clicking the button would start a new pull request on a repo of my choice with the content of the workflow template from this repo. — Reply to this email directly, view it on GitHub <#1302 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALPN2EHMP5HITDI3HHV4STUUNBIHANCNFSM5JZWFCKA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- Jose Palafox Technical Partnerships and Engineering @ GitHub ***@***.*** 503.877.2403

laurentsimon · 2022-01-04T19:18:50Z

Unfortunately Stater workflows and Marketplace are two separate entities right now. The Marketplace entry is the generic action that just runs that scanner, usually we ask partners to embed the additional workflow in the description there. The stater-workflow will be accessible through the GH.com UI in the actions tab.
…
On Tue, Jan 4, 2022 at 11:14 AM laurentsimon @.> wrote: one question I have is where will users be prompted with this workflow. I looked at https://github.com/marketplace/actions/anchore-container-scan which is defined in the starter-workflows, but when I click "use latest version" it only shows uses: ... not the entire workflow template in this repo. I was expecting that clicking the button would start a new pull request on a repo of my choice with the content of the workflow template from this repo. — Reply to this email directly, view it on GitHub <#1302 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AALPN2EHMP5HITDI3HHV4STUUNBIHANCNFSM5JZWFCKA . You are receiving this because you were mentioned.Message ID: @.>
-- Jose Palafox Technical Partnerships and Engineering @ GitHub @.*** 503.877.2403

thanks for the info. It would be great to have the maketplace use the starter-workflows too: that's where I personally go to search for actions, not in the Action settings.

Thanks everyone for helping review the PR and for answering my questions!

laurentsimon · 2022-01-04T19:20:03Z

how long does it take for the action to be available in the Action tab?

josepalafox · 2022-01-04T20:15:14Z

.com deploys happen pretty regularly should be imminent in the next 24-48.

…

On Tue, Jan 4, 2022, 11:20 laurentsimon ***@***.***> wrote: how long does it take for the action to be available in the Action tab? — Reply to this email directly, view it on GitHub <#1302 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALPN2HA6PCY4C52UDLTVRLUUNB65ANCNFSM5JZWFCKA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

laurentsimon requested a review from a team as a code owner December 10, 2021 17:53

github-actions Bot added the code-scanning Related to workflows that show on the Code Scanning setup page label Dec 10, 2021

nickfyson suggested changes Dec 16, 2021

View reviewed changes

Comment thread code-scanning/properties/scorecards.properties.json Outdated

Comment thread code-scanning/scorecards.yml Outdated

Comment thread code-scanning/properties/scorecards.properties.json

Comment thread code-scanning/scorecards.yml

Comment thread code-scanning/scorecards.yml Outdated

laurentsimon force-pushed the feat/scorecard branch from fc16a2f to 588b44b Compare December 16, 2021 18:26

nickfyson reviewed Dec 22, 2021

View reviewed changes

Comment thread code-scanning/properties/scorecards.properties.json

Comment thread code-scanning/properties/scorecards.properties.json

Mguiteria approved these changes Dec 23, 2021

View reviewed changes

Successful83 approved these changes Dec 26, 2021

View reviewed changes

laurentsimon force-pushed the feat/scorecard branch from 938afd2 to 54c5923 Compare December 28, 2021 17:50

laurentsimon mentioned this pull request Jan 4, 2022

✨ Add documentation ossf/scorecard-action#31

Merged

laurentsimon requested a review from a team as a code owner January 4, 2022 18:08

laurentsimon force-pushed the feat/scorecard branch from 157b687 to 23b4603 Compare January 4, 2022 18:26

laurentsimon added 11 commits January 4, 2022 18:26

add scorecards config

794e910

use hash

0e50194

comments

a00db44

pin actions

a894da7

url

9e49744

update text

f38127b

reduce text

48edda6

updates

07be376

updates

7c57e8a

updates

4077291

add icon

b73f59a

use v0.0.1

d0dba52

laurentsimon force-pushed the feat/scorecard branch from 23b4603 to d0dba52 Compare January 4, 2022 18:26

nickfyson approved these changes Jan 4, 2022

View reviewed changes

nickfyson merged commit 51e7c8e into actions:main Jan 4, 2022

nexoracontrol-ops mentioned this pull request Sep 28, 2026

# AI CLI 工具社区动态日报 2026-07-15 #3463

Open

Conversation

laurentsimon commented Dec 10, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pre-requisites

cc @josepalafox

Tasks

Uh oh!

laurentsimon commented Dec 16, 2021

Uh oh!

nickfyson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

laurentsimon commented Dec 16, 2021

Uh oh!

nickfyson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

laurentsimon commented Dec 22, 2021

Uh oh!

nickfyson commented Dec 22, 2021

Uh oh!

laurentsimon commented Dec 23, 2021

Uh oh!

josepalafox commented Dec 23, 2021

Uh oh!

laurentsimon commented Dec 28, 2021

Uh oh!

inferno-chromium commented Dec 29, 2021

Uh oh!

laurentsimon commented Jan 4, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nickfyson left a comment

Choose a reason for hiding this comment

Uh oh!

josepalafox commented Jan 4, 2022 via email

Uh oh!

laurentsimon commented Jan 4, 2022

Uh oh!

laurentsimon commented Jan 4, 2022

Uh oh!

josepalafox commented Jan 4, 2022 via email

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

laurentsimon commented Dec 10, 2021 •

edited

Loading

laurentsimon commented Jan 4, 2022 •

edited

Loading