-
## Issue description
Hello, I'm working on behalf of Google and the [OpenSSF][ossf] to help essential open-source projects improve their supply-chain security. The OpenSSF is a non-profit foundatio…
-
https://github.com/ossf/scorecard
Would be nice to get these results visible. They have a GitHub Action that we could use.
The installation instructions say:
> One Scorecards check ([Branch-Pro…
-
**Is your feature request related to a problem? Please describe.**
It is recommended to pin github actions by their commit hash to ensure reproduciability and enhance the supply chain security: https…
-
**Is your feature request related to a problem? Please describe.**
Hello, I'm Joyce Brum, this issue is not related to any specific problem, but to overall security of the project.
I am working on…
-
[OpenSSF](https://openssf.org) recently released a [security scorecards](https://github.com/ossf/scorecard) project for open source software. The goals of this project are:
> 1. Automate analysis a…
-
**Is your feature request related to a problem? Please describe.**
It would be helpful to be able to run scorecard scans between any two releases of a repo. This way it would be useful to know the ch…
-
https://github.com/ossf/scorecard-action
-
Token permissions (from OpenSSF Scorecard) [more info](https://clomonitor.io/docs/topics/checks/#token-permissions-from-openssf-scorecard)
-
At https://github.com/step-security/secure-workflows we are building a knowledge-base (KB) of GITHUB_TOKEN permissions needed by different GitHub Actions. When developers try to set minimum token perm…
-
This repo is signed up as part of the KubeCon [Security Slam](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/attend/experiences/#security-slam). I'm bringing to your attention…