Closed harshitasao closed 2 weeks ago
The backport workflow can only be triggered with a custom label add by maintainers on PRs, this workflow does not run by default, so a malicious PR would not be able to read any GHA secrets. Can we exclude this workflow from the scorecard scanner?
The backport workflow can only be triggered with a custom label add by maintainers on PRs, this workflow does not run by default, so a malicious PR would not be able to read any GHA secrets. Can we exclude this workflow from the scorecard scanner?
I don't think we can exclude a workflow from the scorecard scanner.
Closing this issue as all the task are done!
Hi, I'm Harshita. I’m working with CNCF and the Google Open Source Security Team for the GSoC 2024 term. We are collaborating to enhance security practices across various CNCF projects. The goal is to improve security for all CNCF projects by both using OpenSSF Scorecards and implementing its security improvements.
As this project already has scorecard action, I'm here to increase the final score by going over each check. I've listed all of the checks where work needs to be done, in order of its criticality. I plan to submit each PR for each fix. Please let me know what you think and for which ones a PR is welcome that I will submit it ASAP.
Current Score: 8.6 Improved Score: 8.8
Scorecard report: https://scorecard.dev/viewer/?uri=github.com/fluxcd/flux2
Here's a few checks we can work on to improve the project's security posture:
[ ] Dangerous-Workflow: Score = 0
[X] Token-Permissions: Score = 9
[X] Pinned-Dependencies: Score = 6
/cc @joycebrum @diogoteles08 @pnacht @nate-double-u