ci: add OpenSSF Scorecard workflow by tym83 · Pull Request #2720 · cozystack/cozystack

Timur Tukaev (tym83) · 2026-05-23T04:12:24Z

What this PR does

Adds a GitHub Actions workflow that runs the OpenSSF Scorecard on this repository.

Schedule

Weekly on Mondays at 06:00 UTC
On branch protection rule changes
On pushes to main
Manual dispatch

Where results go

Public scorecard.dev — transparency for adopters and reviewers (CNCF DD).
Code-scanning dashboard (Security tab) — for in-team triage of individual findings.
SARIF artifact retained for 5 days for local inspection.

Token permissions

Default read-all, with the minimum required scopes elevated only inside the analysis job:

security-events: write — upload to code scanning
id-token: write — publish to scorecard.dev via OIDC, no long-lived secret
contents: read, actions: read

Why no README badge yet

This PR enables the workflow but does not add a badge to the README. Once the first scans have completed and quick-win improvements (token permissions across other workflows, dependency pinning in workflows, etc.) have landed, a follow-up PR will add the badge.

Context

Tracked under the project's CNCF Incubation readiness work and the in-progress security self-assessment.
Companion to the OpenSSF Best Practices passing badge (https://www.bestpractices.dev/en/projects/10177) — Scorecard adds machine-verifiable, continuously-updated evidence; Best Practices captures self-attested controls.

Release note

```release-note
NONE
```

Summary by CodeRabbit

Chores
- Added automated security scanning to the development process to continuously monitor codebase health and security posture.

Runs the OpenSSF Scorecard action on: - weekly schedule (Mon 06:00 UTC) - branch protection rule changes - pushes to main - manual dispatch Publishes results to: - the public OpenSSF Scorecard API (scorecard.dev) for transparency - the GitHub code-scanning dashboard (Security tab) for triage No README badge is added yet — the badge will be introduced in a follow-up PR once the first scans have run and any quick-win improvements (token permissions, dependency pinning) have landed. Aligns with the project's CNCF Incubation readiness work and the security self-assessment in progress. Signed-off-by: Timur Tukaev <timur.tukaev@aenix.io>

coderabbitai · 2026-05-23T04:12:31Z

📝 Walkthrough

Walkthrough

This PR introduces a new GitHub Actions workflow (scorecard.yml) that runs OpenSSF Scorecard security assessments automatically on a weekly Monday schedule, on pushes to the main branch, and via manual dispatch. The workflow generates and publishes SARIF results to GitHub code scanning while maintaining minimal repository permissions.

Changes

Security Scanning Workflow Setup

Layer / File(s)	Summary
Workflow triggers and permission model `.github/workflows/scorecard.yml` (lines 1–29)	Workflow runs on a weekly cron schedule (Mondays 06:00 UTC), on `main` branch pushes, and supports manual dispatch. Default permissions are read-only; the `analysis` job adds `security-events` and `id-token` permissions specifically for publishing results.
Scorecard scanning and result publication `.github/workflows/scorecard.yml` (lines 30–55)	Job runs on `ubuntu-latest`, checks out code without persisting credentials, executes the Scorecard action to generate `results.sarif`, uploads the SARIF as a workflow artifact, and publishes results to GitHub code scanning via SARIF upload.

🎯 2 (Simple) | ⏱️ ~8 minutes

🐰 A scorecard so fine,
Security checks in a line,
Scanning every week with care,
SARIF results we proudly share!
🔐✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'ci: add OpenSSF Scorecard workflow' accurately and concisely describes the main change: adding a GitHub Actions workflow for OpenSSF Scorecard security assessment.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/enable-scorecard-action

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist · 2026-05-23T04:15:15Z

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/scorecard.yml:
- Line 32: The workflow uses mutable action tags—replace each occurrence of
actions/checkout@v4, ossf/scorecard-action@v2, actions/upload-artifact@v4, and
github/codeql-action/upload-sarif@v3 with the corresponding full commit SHA for
the specific action release you want pinned; locate the correct commit SHA on
each action's GitHub repository (Releases/Tags), update the uses lines to use
the full SHA (e.g., actions/checkout@<full-sha>) so the workflow references an
immutable commit, and commit the change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 579a1c33-7790-4031-82eb-fb55764bcdcb

📥 Commits

Reviewing files that changed from the base of the PR and between b689613 and 2396d08.

📒 Files selected for processing (1)

.github/workflows/scorecard.yml

coderabbitai · 2026-05-23T04:17:14Z

+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4


⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Read-only verification: confirm there are no tag-based action refs left. rg -nP '^\s*uses:\s*[^@]+@v\d+(\.\d+)?$' .github/workflows/scorecard.yml # Expected: no output after pinning.

Repository: cozystack/cozystack

Length of output: 240

🏁 Script executed:

#!/bin/bash set -euo pipefail FILE=".github/workflows/scorecard.yml" echo "== Uses lines ==" rg -n '^\s*uses:\s*' "$FILE" echo echo "== Uses with tag refs like `@v4` / `@v2.1` / `@v3` ==" rg -nP '^\s*uses:\s*[^@]+@v\d+(\.\d+)?$' "$FILE" || true echo echo "== Uses with commit-SHA refs (40 hex chars) ==" rg -nP '^\s*uses:\s*[^@]+@[0-9a-fA-F]{40}$' "$FILE" || true echo echo "== File excerpt (1-90) ==" nl -ba "$FILE" | sed -n '1,90p'

Repository: cozystack/cozystack

Length of output: 620

Pin all uses actions to full commit SHAs in scorecard.yml.

The workflow still references mutable action tags:

actions/checkout@v4 (32)

ossf/scorecard-action@v2 (37)

actions/upload-artifact@v4 (46)

github/codeql-action/upload-sarif@v3 (53)

Replace each @v* with the corresponding immutable commit SHA to prevent silent upstream changes.

Suggested change

- - name: Checkout repository - uses: actions/checkout@v4 + - name: Checkout repository + uses: actions/checkout@<FULL_COMMIT_SHA> - - name: Run analysis - uses: ossf/scorecard-action@v2 + - name: Run analysis + uses: ossf/scorecard-action@<FULL_COMMIT_SHA> - - name: Upload SARIF as artifact - uses: actions/upload-artifact@v4 + - name: Upload SARIF as artifact + uses: actions/upload-artifact@<FULL_COMMIT_SHA> - - name: Upload SARIF to code-scanning - uses: github/codeql-action/upload-sarif@v3 + - name: Upload SARIF to code-scanning + uses: github/codeql-action/upload-sarif@<FULL_COMMIT_SHA>

🧰 Tools

🪛 zizmor (1.25.2)

[error] 32-32: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/scorecard.yml at line 32, The workflow uses mutable action tags—replace each occurrence of actions/checkout@v4, ossf/scorecard-action@v2, actions/upload-artifact@v4, and github/codeql-action/upload-sarif@v3 with the corresponding full commit SHA for the specific action release you want pinned; locate the correct commit SHA on each action's GitHub repository (Releases/Tags), update the uses lines to use the full SHA (e.g., actions/checkout@<full-sha>) so the workflow references an immutable commit, and commit the change.

## What this PR does Fixes the OpenSSF Scorecard workflow added in #2720. The initial workflow used floating major-version tags (`@v2`, `@v4`, `@v3`). `ossf/scorecard-action` does not publish a floating `v2` tag — only specific patch releases — so the first scheduled run failed: > Unable to resolve action `ossf/scorecard-action@v2`, unable to find version `v2` This PR pins every action by its full commit SHA with a trailing comment showing the human-readable version. This also satisfies the **Pinned-Dependencies** Scorecard check itself. - `actions/checkout@de0fac2` (v6.0.2) - `ossf/scorecard-action@4eaacf0` (v2.4.3) - `actions/upload-artifact@043fb46` (v7.0.1) - `github/codeql-action/upload-sarif@03e4368` (v3) ### Release note ```release-note NONE ```  ## Summary by CodeRabbit * **Chores** * Updated CI/CD infrastructure dependency versions to maintain security and stability. **Note:** This release contains no user-facing changes.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/cozystack/cozystack/pull/2721?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

github-actions Bot added area/uncategorized PR auto-labeler could not map title scope to a known area/*; please review size/M This PR changes 30-99 lines, ignoring generated files labels May 23, 2026

Timur Tukaev (tym83) marked this pull request as ready for review May 23, 2026 04:15

Timur Tukaev (tym83) requested review from IvanHunters, Andrey Kolkov (androndo), Andrei Kvapil (kvaps), Aleksei Sviridkin (lexfrei), Timofei Larkin (lllamnyp), myasnikovdaniil and Kirill Ilin (sircthulhu) as code owners May 23, 2026 04:15

dosubot Bot added area/ci Issues or PRs related to CI workflows, GitHub Actions, automation security Security-related issues and features labels May 23, 2026

coderabbitai Bot reviewed May 23, 2026

View reviewed changes

Timur Tukaev (tym83) merged commit 3a8d1c5 into main May 23, 2026
14 checks passed

Timur Tukaev (tym83) deleted the chore/enable-scorecard-action branch May 23, 2026 04:22

Timur Tukaev (tym83) mentioned this pull request May 23, 2026

ci: pin Scorecard workflow actions by SHA #2721

Merged

This was referenced Jun 19, 2026

ci: add CodeQL workflow for Go (SAST) #2851

Merged

ci: prune stale and redundant workflows #2982

Merged

coderabbitai Bot mentioned this pull request Jul 7, 2026

ci: harden GitHub Actions workflows for OpenSSF Scorecard (pin, permissions, zizmor gate) #3223

Merged

Navigation Menu

Uh oh!

ci: add OpenSSF Scorecard workflow - #2720

ci: add OpenSSF Scorecard workflow#2720
Timur Tukaev (tym83) merged 1 commit into
mainfrom
chore/enable-scorecard-action

Timur Tukaev (tym83) commented May 23, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 23, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

gemini-code-assist Bot commented May 23, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot May 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

Timur Tukaev (tym83) commented May 23, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Schedule

Where results go

Token permissions

Why no README badge yet

Context

Release note

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

gemini-code-assist Bot commented May 23, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot May 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Timur Tukaev (tym83) commented May 23, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 23, 2026 •

edited

Loading