search

antonbabenko / pre-commit-terraform

pre-commit git hooks to take care of Terraform configurations 🇺🇦
MIT License
3.23k stars 541 forks source link

Improve OpenSSF score #712

Open nitrocode opened 2 months ago

nitrocode commented 2 months ago

What problem are you facing?

Adoption in a new organization

How could pre-commit-terraform help solve your problem?

Renovatebot includes an openssf score on every PR update for this repo. Due to low scores, this can irk developers and management.

Please consider improving the OpenSSF score of this repo. Current score is 6.7 which is not and could be better. The higher the score, the more objective integrity the community will have towards the project.

https://github.com/ossf/scorecard

https://securityscorecards.dev/viewer/?uri=github.com/antonbabenko/pre-commit-terraform

image

Some small improvements

Some big improvements

MaxymVlasov commented 2 months ago

@nitrocode can you please point me where you find such score in Renovate PRs for pre-commit hooks?

image

MaxymVlasov commented 2 months ago

We definitely want 9+/10, but firstly I need to understand how to enable such scores for Renovate, as I never disable it in https://github.com/SpotOnInc/renovate-config/blob/main/default.template.json5

nitrocode commented 2 months ago

Hi @MaxymVlasov, this is how I have enabled the scores in some orgs for renovate PRs

https://docs.renovatebot.com/presets-security/#securityopenssf-scorecard

nitrocode commented 2 months ago

Also the results may be better by adopting the GitHub action. This should get the branch protections

https://github.com/ossf/scorecard-action