Add OSSF Scorecard GitHub Action to OSPO GitHub Actions

[jmeridth]

Is your feature request related to a problem?

No visibilty of supply chain security in our GitHub Actions

Related OSPO Tool

automatic-contrib-prs GitHub Action, cleanowners GitHub Action, contributors GitHub Action, evergreen GitHub Action, issues-metrics GitHub Action, stale-repos GitHub Action

Describe the solution you'd like

Summary

Add the OSSF Scorecard GitHub Action so we can have automated supply chain security detection. Allows us to add badge to README to show users we are using open source security tooling.

Corresponding Work

Add Tasks that ladder up to this batch

• [x] https://github.com/github/automatic-contrib-prs/issues/52
  • [ ] PR coming soon
• [x] https://github.com/github/cleanowners/issues/49
  • [ ] PR coming soon
• [x] https://github.com/github/contributors/issues/88
  • [ ] PR coming soon
• [x] https://github.com/github/evergreen/issues/90
  • [ ] PR coming soon
• [x] https://github.com/github/issue-metrics/issues/232
  • [ ] PR coming soon
• [x] https://github.com/github/stale-repos/issues/115
  • [ ] https://github.com/github/stale-repos/pull/130

Dependencies

OSSF Scorecard GitHub Action

Supporting Documentation

OSSF Scorecard GitHub Action

Describe alternatives you've considered

No response

Additional context

No response

[jmeridth]

Outstanding question from @zkoppert:

what system or process will we want to put in place to regularly review those scorecards and open issues for action items. Monthly review? Something else?

🤔

[zkoppert]

It would be cool if we could automatically open an issue when the scorecard goes below some threshold.

[jmeridth]

One of our biggest issues is pip dependencies not hashed. A good solution to this is moving to pipenv aka Pipfile and Pipfile.lock. The lock file will automatically contain all hashes for a dependency (similary to package-lock.json or Gemfile). I like this better than managing the hashes ourselves in the requirements.txt files.

I'm testing this move in https://github.com/github/stale-repos/pull/132

I've found two issues though:

• In order to install pip and pipenv in a few files and actions, you have to have the hashes in a requirements.txt file. You can't do pip install with hashes directly on the CLI. 🤦
• it seems dependabot only supports pipenv <= 2021-05-29. Latest version is 2023.12.1. That is currently 88 versions/releases ahead of the supported version. 🤔

[jmeridth]

This is complete. We will iterate through the remediations.