eddiejaoude
commented
1 month ago Example response
{
"date":"2024-09-13T10:15:50Z",
"repo":{
"name":"github.com/EddieHubCommunity/HealthCheck",
"commit":"a164cbfbb3ae601cdb0e09c748d4d28bd6e87e11"
},
"scorecard":{
"version":"v4.13.1",
"commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"
},
"score":5.6,
"checks":[
{
"name":"Binary-Artifacts",
"score":10,
"reason":"no binaries found in the repo",
"details":null,
"documentation":{
"short":"Determines if the project has generated executable (binary) artifacts in the source repository.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"
}
},
{
"name":"Branch-Protection",
"score":0,
"reason":"branch protection not enabled on development/release branches",
"details":[
"Warn: branch protection not enabled for branch 'main'"
],
"documentation":{
"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"
}
},
{
"name":"CI-Tests",
"score":9,
"reason":"9 out of 10 merged PRs checked by a CI test -- score normalized to 9",
"details":null,
"documentation":{
"short":"Determines if the project runs tests before pull requests are merged.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"
}
},
{
"name":"CII-Best-Practices",
"score":0,
"reason":"no effort to earn an OpenSSF best practices badge detected",
"details":null,
"documentation":{
"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"
}
},
{
"name":"Code-Review",
"score":0,
"reason":"found 20 unreviewed changesets out of 20 -- score normalized to 0",
"details":null,
"documentation":{
"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"
}
},
{
"name":"Contributors",
"score":10,
"reason":"13 different organizations found -- score normalized to 10",
"details":[
"Info: contributors work for EddieHubCommunity,GitHub-Stars,Profiden,Youth-Icon,darkmash-org,inofy,kubernetes,kubernetes-client,kubernetes-csi,kubernetes-sigs,mediasyntax,open source engineer,sabagroup"
],
"documentation":{
"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"
}
},
{
"name":"Dangerous-Workflow",
"score":10,
"reason":"no dangerous workflow patterns detected",
"details":null,
"documentation":{
"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"
}
},
{
"name":"Dependency-Update-Tool",
"score":10,
"reason":"update tool detected",
"details":[
"Info: tool 'Dependabot' is used: .github/dependabot.yml:1"
],
"documentation":{
"short":"Determines if the project uses a dependency update tool.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"
}
},
{
"name":"Fuzzing",
"score":0,
"reason":"project is not fuzzed",
"details":[
"Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)",
"Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)",
"Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)",
"Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)",
"Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)",
"Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)",
"Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)",
"Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)",
"Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)",
"Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)",
"Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)",
"Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)",
"Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"
],
"documentation":{
"short":"Determines if the project uses fuzzing.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"
}
},
{
"name":"License",
"score":10,
"reason":"license file detected",
"details":[
"Info: License file found in expected location: LICENSE:1",
"Info: FSF or OSI recognized license: LICENSE:1"
],
"documentation":{
"short":"Determines if the project has defined a license.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"
}
},
{
"name":"Maintained",
"score":0,
"reason":"repo was created 67 days ago, not enough maintenance history",
"details":[
"Warn: repo was created in the last 90 days (Created at: 2024-07-07T13:11:06Z), please review its contents carefully"
],
"documentation":{
"short":"Determines if the project is \"actively maintained\".",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"
}
},
{
"name":"Packaging",
"score":10,
"reason":"publishing workflow detected",
"details":[
"Info: GitHub/GitLab publishing workflow used in run https://api.github.com/repos/EddieHubCommunity/HealthCheck/actions/runs/10844380566: .github/workflows/docker.yml:28"
],
"documentation":{
"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"
}
},
{
"name":"Pinned-Dependencies",
"score":3,
"reason":"dependency not pinned by hash detected -- score normalized to 3",
"details":[
"Warn: third-party GitHubAction not pinned by hash: .github/workflows/checks.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/checks.yml/main?enable=pin",
"Warn: third-party GitHubAction not pinned by hash: .github/workflows/deploy.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/deploy.yml/main?enable=pin",
"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/deploy.yml/main?enable=pin",
"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/deploy.yml/main?enable=pin",
"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
"Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
"Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
"Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
"Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/lint.yml/main?enable=pin",
"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/lint.yml/main?enable=pin",
"Warn: third-party GitHubAction not pinned by hash: .github/workflows/lint.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/lint.yml/main?enable=pin",
"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/playwright.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/playwright.yml/main?enable=pin",
"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/playwright.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/playwright.yml/main?enable=pin",
"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/release.yml/main?enable=pin",
"Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/release.yml/main?enable=pin",
"Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/release.yml/main?enable=pin",
"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/scorecard.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/scorecard.yml/main?enable=pin",
"Warn: containerImage not pinned by hash: Dockerfile:3",
"Warn: containerImage not pinned by hash: Dockerfile:17",
"Warn: containerImage not pinned by hash: Dockerfile.dev:2",
"Info: 2 out of 14 GitHub-owned GitHubAction dependencies pinned",
"Info: 1 out of 10 third-party GitHubAction dependencies pinned",
"Info: 0 out of 3 containerImage dependencies pinned",
"Info: 7 out of 7 npmCommand dependencies pinned"
],
"documentation":{
"short":"Determines if the project has declared and pinned the dependencies of its build process.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"
}
},
{
"name":"SAST",
"score":9,
"reason":"SAST tool is not run on all commits -- score normalized to 9",
"details":[
"Warn: 18 commits out of 20 are checked with a SAST tool",
"Warn: CodeQL tool not detected"
],
"documentation":{
"short":"Determines if the project uses static code analysis.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"
}
},
{
"name":"Security-Policy",
"score":9,
"reason":"security policy file detected",
"details":[
"Info: security policy file detected: SECURITY.MD:1",
"Info: Found linked content: SECURITY.MD:1",
"Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)",
"Info: Found text in security policy: SECURITY.MD:1"
],
"documentation":{
"short":"Determines if the project has published a security policy.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"
}
},
{
"name":"Signed-Releases",
"score":-1,
"reason":"no releases found",
"details":[
"Warn: no GitHub releases found"
],
"documentation":{
"short":"Determines if the project cryptographically signs release artifacts.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"
}
},
{
"name":"Token-Permissions",
"score":0,
"reason":"detected GitHub workflow tokens with excessive permissions",
"details":[
"Info: topLevel permissions set to 'read-all': .github/workflows/checks.yml:2",
"Info: topLevel permissions set to 'read-all': .github/workflows/deploy.yml:2",
"Info: topLevel permissions set to 'read-all': .github/workflows/docker.yml:2",
"Warn: no topLevel permission defined: .github/workflows/lint.yml:1: Visit https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/lint.yml/main?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)",
"Warn: no topLevel permission defined: .github/workflows/playwright.yml:1: Visit https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/playwright.yml/main?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)",
"Warn: no topLevel permission defined: .github/workflows/release.yml:1: Visit https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/release.yml/main?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)",
"Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:18",
"Info: no jobLevel write permissions found"
],
"documentation":{
"short":"Determines if the project's workflows follow the principle of least privilege.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"
}
},
{
"name":"Vulnerabilities",
"score":9,
"reason":"1 existing vulnerabilities detected",
"details":[
"Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j"
],
"documentation":{
"short":"Determines if the project has open, known unfixed vulnerabilities.",
"url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"
}
}
]
}
Description
There is an API to query results for the repo
https://github.com/ossf/scorecard?tab=readme-ov-file
Tasks
Resources
Screenshots
No response
Additional information
No response