Merge branch 'main' into permissions

code-scanning/properties/apisec-scan.properties.json

@@ -1,7 +1,7 @@
 {
   "name": "APIsec Scan",
   "creator": "APIsec",
-  "description": "APIsec addresses the critical need to secure APIs before they reach production. APIsec provides the industry’s only automated and continuous API testing platform that uncovers security vulnerabilities and logic flaws in APIs. Clients rely on APIsec to evaluate every update and release, ensuring that no APIs go to production with vulnerabilities.",
+  "description": "APIsec provides the industry’s only automated and continuous API testing platform that uncovers security vulnerabilities and logic flaws in APIs.",
   "iconName": "apisec",
   "categories": [
     "Code Scanning",

code-scanning/properties/cloudrail.properties.json

@@ -1,7 +1,7 @@
 {
     "name": "cloudrail",
     "creator": "Indeni Cloudrail",
-    "description": "Cloudrail can be used to scan your infrastructure-as-code files for potential security and compliance issues. The Cloudrail action is often used as part of both CI workflows (on pull_request) and on CD workflows to identify potential issues.",
+    "description": "Cloudrail can be used to scan your infrastructure-as-code files for potential security and compliance issues.",
     "iconName": "cloudrail",
     "categories": ["Code Scanning", "HCL"]
 }

code-scanning/properties/pmd.properties.json

@@ -1,7 +1,7 @@
 {
     "name": "pmd",
     "creator": "pmd",
-    "description": "PMD is a static source code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth. It supports Java, JavaScript, Salesforce.com Apex and Visualforce, Modelica, PLSQL, Apache Velocity, XML, XSL, Scala.",
+    "description": "PMD is a static source code analyzer. It supports Java, JavaScript, Apex and Visualforce, Modelica, PLSQL, Apache Velocity, XML, XSL, Scala.",
     "iconName": "pmd",
     "categories": [
         "Code Scanning", 
@@ -13,7 +13,6 @@
         "Apache Velocity",
         "XML",
         "XSl",
-        "Scala", 
-        "Apex"
+        "Scala"
     ]
 }

code-scanning/properties/scorecards.properties.json

@@ -1,7 +1,7 @@
 {
-    "name": "OSSF Scorecards supply-chain security analysis",
-    "creator": "Open Source Security Foundation (OpenSSF) - https://github.com/ossf",
-    "description": "Scorecards is a static analysis tool to assess the security posture of your project",
+    "name": "OSSF Scorecards",
+    "creator": "Open Source Security Foundation (OpenSSF)",
+    "description": "Scorecards is a static supply-chain security analysis tool to assess the security posture of your project",
     "iconName": "scorecards",
     "categories": ["Code Scanning"]
 }

code-scanning/scorecards.yml

@@ -1,5 +1,5 @@
 name: Scorecards supply-chain security
-on: 
+on:
   # Only the default branch is supported.
   branch_protection_rule:
   schedule:
@@ -17,7 +17,9 @@ jobs:
     permissions:
       # Needed to upload the results to code-scanning dashboard.
       security-events: write
-    
+      actions: read
+      contents: read
+
     steps:
       - name: "Checkout code"
         uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.4.0
@@ -25,17 +27,17 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@175f59783fa96e44dd6fa96619ab7bdacab56b5c # v0.0.1
+        uses: ossf/scorecard-action@c8416b0b2bf627c349ca92fc8e3de51a64b005cf # v1.0.2
         with:
           results_file: results.sarif
           results_format: sarif
           # Read-only PAT token. To create it,
           # follow the steps in https://github.com/ossf/scorecard-action#pat-token-creation.
-          repo_token: ${{ secrets.SCORECARD_TOKEN }}
+          repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}
           # Publish the results to enable scorecard badges. For more details, see
           # https://github.com/ossf/scorecard-action#publishing-results.
-          # If you are installing the action on a private repo, set it to `publish_results: false` 
-          # or comment out the following line.
+          # For private repositories, `publish_results` will automatically be set to `false`,
+          # regardless of the value entered here.
           publish_results: true
 
       # Upload the results as artifacts (optional).
@@ -45,7 +47,7 @@ jobs:
           name: SARIF file
           path: results.sarif
           retention-days: 5
-      
+
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
         uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # v1.0.26

code-scanning/trivy.yml

@@ -14,8 +14,14 @@ on:
   schedule:
     - cron: $cron-weekly
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
     name: Build
     runs-on: "ubuntu-18.04"
     steps: