Add OpenSSF Scorecard #789
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jtracey93
requested changes
Jun 11, 2024
| # - you want to enable the Branch-Protection check on a *public* repository, or | ||
| # - you are installing Scorecard on a *private* repository | ||
| # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional. | ||
| repo_token: ${{ secrets.SCORECARD_TOKEN }} |
There was a problem hiding this comment.
i dont see this secret in the repo?
Also we have branch protection enabled, so how will that work?
There was a problem hiding this comment.
Good question. It ignores this secret if it does not exist, I added it in case we wanted to go down that route, but doesn't matter that it isn't there.
I added a comment on the work item about this too: https://dev.azure.com/CSUSolEng/Azure%20Landing%20Zones/_workitems/edit/35169#14168293
In summary we need to move away from legacy branch protection rules to using rulesets instead and then we can forget about this secret.
There was a problem hiding this comment.
As discussed on the call with @jaredfholgate, we are good at this point.
oZakari
pushed a commit
that referenced
this pull request
Jun 18, 2024
* Create scorecard.yml * Update README.md
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview/Summary
This PR adds the OpenSSF scorecard and associated badge.
This PR fixes/adds/changes/removes
N/A
Breaking Changes
N/A
Testing Evidence
N/A
As part of this Pull Request I have
.bicepfile/s I am adding/editing are using the latest API version possiblemainbranch