diff --git a/README.md b/README.md index cf48064..e47a40c 100644 --- a/README.md +++ b/README.md @@ -83,6 +83,8 @@ Configure this action by either inlining these options in your workflow file, or | `retry-on-snapshot-warnings`\* | Enable or disable retrying the action every 10 seconds while waiting for dependency submission actions to complete. | `true`, `false` | `false` | | `retry-on-snapshot-warnings-timeout`\* | Maximum amount of time (in seconds) to retry the action while waiting for dependency submission actions to complete. | Any positive integer | 120 | | `warn-only`+ | When set to `true`, the action will log all vulnerabilities as warnings regardless of the severity, and the action will complete with a `success` status. This overrides the `fail-on-severity` option. | `true`, `false` | `false` | +| `show-openssf-scorecard-levels` | When set to `true`, the action will output information about all the known OpenSSF Scorecard scores for the dependencies changed in this pull request. | `true`, `false` | `true` | +| `warn-on-openssf-scorecard-level` | When `show-openssf-scorecard-levels` is set to `true`, this option lets you configure the threshold for when a score is considered too low and gets a :warning: warning in the CI. | Any positive integer | 3 | \*not supported for use with GitHub Enterprise Server diff --git a/src/main.ts b/src/main.ts index 81c7036..71e7a92 100644 --- a/src/main.ts +++ b/src/main.ts @@ -154,6 +154,7 @@ async function run(): Promise { const scorecard = await getScorecardLevels(filteredChanges) summary.addScorecardToSummary(scorecard, config) printScorecardBlock(scorecard, config) + createScorecardWarnings(scorecard, config) } summary.addScannedDependencies(changes) @@ -354,4 +355,21 @@ function printDeniedDependencies( }) } +function createScorecardWarnings( + scorecards: Scorecard, + config: ConfigurationOptions +): void { + // Iterate through the list of scorecards, and if the score is less than the threshold, send a warning + for (const dependency of scorecards.dependencies) { + if ( + dependency.scorecard?.score && + dependency.scorecard?.score < config.warn_on_openssf_scorecard_level + ) { + core.warning( + `${dependency.ecosystem}/${dependency.packageName} has an OpenSSF Scorecard of ${dependency.scorecard?.score} is less than this repository's threshold of ${config.warn_on_openssf_scorecard_level}.` + ) + } + } +} + run()