From d668c4cb8b5f3382c65ebcf1624bab95329b274c Mon Sep 17 00:00:00 2001 From: Pedro Kaj Kjellerup Nacht <15221358+pnacht@users.noreply.github.com> Date: Fri, 7 Oct 2022 14:25:58 +0000 Subject: [PATCH 1/8] Clarify comments in scorecard.yml --- code-scanning/scorecards.yml | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/code-scanning/scorecards.yml b/code-scanning/scorecards.yml index 31a4fa1..1a9119f 100644 --- a/code-scanning/scorecards.yml +++ b/code-scanning/scorecards.yml @@ -1,7 +1,10 @@ name: Scorecards supply-chain security on: - # Only the default branch is supported. + # For Branch-Protection check. Only the default branch is supported. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection branch_protection_rule: + # To guarantee Maintained check is occasionally updated. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained schedule: - cron: $cron-weekly push: @@ -17,11 +20,11 @@ jobs: permissions: # Needed to upload the results to code-scanning dashboard. security-events: write - # Used to receive a badge. + # Needed to publish results and get a badge (see publish_results below). id-token: write - # Needs for private repositories. - contents: read - actions: read + # Uncomment the permissions below if installing in a private repository. + # contents: read + # actions: read steps: - name: "Checkout code" @@ -40,10 +43,13 @@ jobs: # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. # repo_token: ${{ secrets.SCORECARD_READ_TOKEN }} - # Publish the results for public repositories to enable scorecard badges. For more details, see - # https://github.com/ossf/scorecard-action#publishing-results. - # For private repositories, `publish_results` will automatically be set to `false`, regardless - # of the value entered here. + # Public repositories: + # - Publish results to OpenSSF REST API for easy access by consumers + # - Allows the repository to include the Scorecard badge. + # - See https://github.com/ossf/scorecard-action#publishing-results. + # For private repositories: + # - `publish_results` will always be set to `false`, regardless + # of the value entered here. publish_results: true # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF From 493117b7055b853103d64a04bfe76998714e047f Mon Sep 17 00:00:00 2001 From: Pedro Kaj Kjellerup Nacht <15221358+pnacht@users.noreply.github.com> Date: Fri, 7 Oct 2022 18:22:49 +0000 Subject: [PATCH 2/8] Add disclaimer requested in PR template --- code-scanning/scorecards.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/code-scanning/scorecards.yml b/code-scanning/scorecards.yml index 1a9119f..afd2b93 100644 --- a/code-scanning/scorecards.yml +++ b/code-scanning/scorecards.yml @@ -1,3 +1,7 @@ +# This workflow uses actions that are not certified by GitHub. They are provided +# by a third-party and are governed by separate terms of service, privacy +# policy, and support documentation. + name: Scorecards supply-chain security on: # For Branch-Protection check. Only the default branch is supported. See From e9fd3bc4fbab5eb36f309948b4f2b1319ceb35a6 Mon Sep 17 00:00:00 2001 From: Pedro Kaj Kjellerup Nacht Date: Mon, 10 Oct 2022 15:48:40 +0000 Subject: [PATCH 3/8] Update versions/hashes --- code-scanning/scorecards.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/code-scanning/scorecards.yml b/code-scanning/scorecards.yml index afd2b93..0e159aa 100644 --- a/code-scanning/scorecards.yml +++ b/code-scanning/scorecards.yml @@ -32,12 +32,12 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0 + uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@865b4092859256271290c77adbd10a43f4779972 # tag=v2.0.3 + uses: ossf/scorecard-action@e363bfca00e752f91de7b7d2a77340e2e523cb18 # v2.0.4 with: results_file: results.sarif results_format: sarif @@ -51,7 +51,7 @@ jobs: # - Publish results to OpenSSF REST API for easy access by consumers # - Allows the repository to include the Scorecard badge. # - See https://github.com/ossf/scorecard-action#publishing-results. - # For private repositories: + # For private repositories: # - `publish_results` will always be set to `false`, regardless # of the value entered here. publish_results: true @@ -59,7 +59,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # tag=v3.0.0 + uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0 with: name: SARIF file path: results.sarif @@ -67,6 +67,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26 + uses: github/codeql-action/upload-sarif@807578363a7869ca324a79039e6db9c843e0e100 # v2.1.27 with: sarif_file: results.sarif From 8048d62634872e937bf37f33028e4b4448a4d7d4 Mon Sep 17 00:00:00 2001 From: Justin Hutchings Date: Thu, 13 Oct 2022 13:01:48 -0700 Subject: [PATCH 4/8] Add dependency graph Scala builds do not automatically get support for the dependency graph. This addition will upload dependency information to the dependency graph so users get Dependabot alerts. --- ci/scala.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/ci/scala.yml b/ci/scala.yml index 4a3c112..a88374f 100644 --- a/ci/scala.yml +++ b/ci/scala.yml @@ -6,17 +6,24 @@ on: pull_request: branches: [ $default-branch ] +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v3 - name: Set up JDK 11 - uses: actions/setup-java@v2 + uses: actions/setup-java@v3 with: java-version: '11' - distribution: 'adopt' + distribution: 'temurin' + cache: 'sbt' - name: Run tests run: sbt test + # This step uploads information to the GitHub dependency graph and unblocking Dependabot alerts for the repository + - name: Upload dependency graph + uses: scalacenter/sbt-dependency-submission@v2 From 6686f7461a5ea356163d37ef11e325ab03a534bb Mon Sep 17 00:00:00 2001 From: Justin Hutchings Date: Thu, 13 Oct 2022 13:08:31 -0700 Subject: [PATCH 5/8] Add disclaimer --- ci/scala.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ci/scala.yml b/ci/scala.yml index a88374f..9e78672 100644 --- a/ci/scala.yml +++ b/ci/scala.yml @@ -1,3 +1,8 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + name: Scala CI on: From c1444385ea259d1d65245650e32286eb22ea1341 Mon Sep 17 00:00:00 2001 From: Justin Hutchings Date: Mon, 24 Oct 2022 15:24:40 -0700 Subject: [PATCH 6/8] Mark optional and use commit SHA --- ci/scala.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ci/scala.yml b/ci/scala.yml index 9e78672..14ba966 100644 --- a/ci/scala.yml +++ b/ci/scala.yml @@ -29,6 +29,6 @@ jobs: cache: 'sbt' - name: Run tests run: sbt test - # This step uploads information to the GitHub dependency graph and unblocking Dependabot alerts for the repository + # Optional: This step uploads information to the GitHub dependency graph and unblocking Dependabot alerts for the repository - name: Upload dependency graph - uses: scalacenter/sbt-dependency-submission@v2 + uses: scalacenter/sbt-dependency-submission@ab086b50c947c9774b70f39fc7f6e20ca2706c91 From 21885a7e846d33a4d2393c8916620a383e20a189 Mon Sep 17 00:00:00 2001 From: Pedro Kaj Kjellerup Nacht Date: Thu, 27 Oct 2022 13:22:19 +0000 Subject: [PATCH 7/8] Update scorecard-action to 2.0.6 --- code-scanning/scorecards.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/scorecards.yml b/code-scanning/scorecards.yml index 0e159aa..11e305f 100644 --- a/code-scanning/scorecards.yml +++ b/code-scanning/scorecards.yml @@ -37,7 +37,7 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@e363bfca00e752f91de7b7d2a77340e2e523cb18 # v2.0.4 + uses: ossf/scorecard-action@99c53751e09b9529366343771cc321ec74e9bd3d # v2.0.6 with: results_file: results.sarif results_format: sarif From 7714a42d7a7f9901b9ea6589b98c906a544beb13 Mon Sep 17 00:00:00 2001 From: Luca Casonato Date: Mon, 31 Oct 2022 14:15:11 +0100 Subject: [PATCH 8/8] Update denoland/setup-deno workflow This updates the version of the denoland/setup-deno action used in ci/deno.yml starter workflow to a version that uses node16, to remove the warning about node12 workflows being deprecated. The version updated to is the latest released version, v1.1.1: https://github.com/denoland/setup-deno/releases/tag/v1.1.1 --- ci/deno.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ci/deno.yml b/ci/deno.yml index 2234bf6..5ee940d 100644 --- a/ci/deno.yml +++ b/ci/deno.yml @@ -3,7 +3,7 @@ # separate terms of service, privacy policy, and support # documentation. -# This workflow will install Deno then run Deno lint and test. +# This workflow will install Deno then run `deno lint` and `deno test`. # For more information see: https://github.com/denoland/setup-deno name: Deno @@ -27,7 +27,7 @@ jobs: - name: Setup Deno # uses: denoland/setup-deno@v1 - uses: denoland/setup-deno@004814556e37c54a2f6e31384c9e18e983317366 + uses: denoland/setup-deno@9db7f66e8e16b5699a514448ce994936c63f0d54 with: deno-version: v1.x @@ -39,4 +39,4 @@ jobs: run: deno lint - name: Run tests - run: deno test -A --unstable + run: deno test -A