chore: add OpenSSF Scorecard workflow by shenxianpeng · Pull Request #454 · commit-check/commit-check

shenxianpeng · 2026-07-03T08:54:34Z

Summary

Add OpenSSF Scorecard CI workflow that automatically scans the repository for security best practices on every push to main, and supports manual trigger via workflow_dispatch.

Changes

Added .github/workflows/scorecard.yml

Triggers

Trigger	Description
`push` to `main`	Runs automatically after every merge to main
`workflow_dispatch`	Supports manual trigger from GitHub Actions UI

Workflow Steps

actions/checkout — Check out the repo without persisting credentials
ossf/scorecard-action — Run Scorecard analysis, output results in SARIF format, and publish to the OpenSSF public API
actions/upload-artifact — Upload the SARIF results as a build artifact (retained for 5 days)

Effects

The Scorecard badge in README stays up-to-date in real time
SARIF results can be viewed in the GitHub Security tab
Manual re-evaluation is available anytime via workflow_dispatch

Notes

Uses the latest recommended Scorecard action (v2.4.1) with commit pinning
Follows the principle of least privilege: id-token: write (for publishing results to the API) + contents: read
No conflicts with existing workflows (main.yml, publish-package.yml, etc.)

Summary by CodeRabbit

Chores
- Added an automated security scoring check that runs on main branch updates and can also be triggered manually.
- Publishes scan results as a downloadable artifact for short-term review.
- Updated permissions for the workflow to support secure report generation and publishing.

Add a GitHub Actions workflow that runs OpenSSF Scorecard analysis on every push to main and supports manual trigger (workflow_dispatch). The workflow: - Checks out the repo without persisting credentials - Runs ossf/scorecard-action to generate SARIF results - Publishes results to the OpenSSF public API (updates the badge) - Uploads the SARIF file as a build artifact (retained for 5 days)

netlify · 2026-07-03T08:54:38Z

✅ Deploy Preview for commit-check ready!

Name	Link
🔨 Latest commit	`588239c`
🔍 Latest deploy log	https://app.netlify.com/projects/commit-check/deploys/6a4778cc98d80f0008bc171c
😎 Deploy Preview	https://deploy-preview-454--commit-check.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

coderabbitai · 2026-07-03T08:54:56Z

📝 Walkthrough

Walkthrough

This PR adds a new GitHub Actions workflow, "OpenSSF Scorecard," that runs on pushes to the main branch and on manual dispatch. It checks out the repository, executes the OpenSSF Scorecard action to generate and publish SARIF results, and uploads the SARIF file as a build artifact with 5-day retention.

Changes

Scorecard CI Workflow

Layer / File(s)	Summary
Add Scorecard workflow `.github/workflows/scorecard.yml`	New workflow triggered on push to `main` and manual dispatch runs `ossf/scorecard-action` with `id-token: write`/`contents: read` permissions, generates `results.sarif`, publishes results, and uploads the SARIF file as a build artifact with 5-day retention.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested labels: ci, github_actions

Suggested reviewers: N/A

Poem:
A rabbit hops through YAML lines,
Scorecard checks and SARIF shines,
On main it runs, on click it too,
Artifacts saved for me and you,
Five days kept, then off it flies! 🐰

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding an OpenSSF Scorecard GitHub Actions workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/add-openssf-scorecard-workflow

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

sonarqubecloud · 2026-07-03T08:54:59Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

coderabbitai

🧹 Nitpick comments (1)

.github/workflows/scorecard.yml (1)
8-30: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Consider surfacing SARIF results in the repo's Security tab.

This workflow publishes results to the OpenSSF public API and stores the SARIF as a 5-day build artifact, but never uploads it to GitHub's code-scanning dashboard. The OSSF-documented example workflow additionally uses github/codeql-action/upload-sarif (needing security-events: write) so results are visible under the Security tab for repo maintainers, not just via the artifact or public API.

If this omission is intentional (e.g. deferred to a follow-up PR), feel free to disregard.
♻️ Suggested addition
 permissions:
   id-token: write
   contents: read
+  security-events: write
 
 jobs:
   analysis:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 
       - uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b757266b50d # v2.4.1
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
 
       - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
+
+      - uses: github/codeql-action/upload-sarif@<pin-latest-v3-or-v4-sha> # verify latest tag
+        with:
+          sarif_file: results.sarif
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/scorecard.yml around lines 8 - 30, The scorecard workflow
generates SARIF and uploads it as an artifact, but it does not send the results
to GitHub’s code-scanning UI. Update the workflow around the existing
ossf/scorecard-action and actions/upload-artifact steps to also upload
results.sarif with github/codeql-action/upload-sarif, and add the required
security-events: write permission alongside the current permissions block so the
findings appear in the repo’s Security tab.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/scorecard.yml:
- Around line 8-30: The scorecard workflow generates SARIF and uploads it as an
artifact, but it does not send the results to GitHub’s code-scanning UI. Update
the workflow around the existing ossf/scorecard-action and
actions/upload-artifact steps to also upload results.sarif with
github/codeql-action/upload-sarif, and add the required security-events: write
permission alongside the current permissions block so the findings appear in the
repo’s Security tab.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 37e7edfb-6fe5-4969-9af1-ed145a9bdda6

📥 Commits

Reviewing files that changed from the base of the PR and between 230b4a4 and 588239c.

📒 Files selected for processing (1)

.github/workflows/scorecard.yml

shenxianpeng requested a review from a team as a code owner July 3, 2026 08:54

github-actions Bot added the chore label Jul 3, 2026

shenxianpeng merged commit 73176a6 into main Jul 3, 2026
11 of 12 checks passed

shenxianpeng deleted the chore/add-openssf-scorecard-workflow branch July 3, 2026 08:56

coderabbitai Bot reviewed Jul 3, 2026

View reviewed changes

Navigation Menu

Uh oh!

Uh oh!

chore: add OpenSSF Scorecard workflow - #454

chore: add OpenSSF Scorecard workflow#454
shenxianpeng merged 1 commit into
mainfrom
chore/add-openssf-scorecard-workflow

shenxianpeng commented Jul 3, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

netlify Bot commented Jul 3, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

sonarqubecloud Bot commented Jul 3, 2026

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

shenxianpeng commented Jul 3, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Triggers

Workflow Steps

Effects

Notes

Summary by CodeRabbit

Uh oh!

netlify Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for commit-check ready!

Uh oh!

coderabbitai Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

sonarqubecloud Bot commented Jul 3, 2026

Quality Gate passed

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

shenxianpeng commented Jul 3, 2026 •

edited by coderabbitai Bot

Loading

netlify Bot commented Jul 3, 2026 •

edited

Loading

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading