Open harshitasao opened 4 weeks ago
Hi @harshitasao 👋 and welcome back :) I'd say these would be welcome PR's right away:
The rest would likely need to be done in collaboration with @johanfylling , @ashutosh-narkar , and others, as there might be things to consider before making those changes.
Token-Permissions seems ok as well. This probably involves adding 👇 on the workflows unless I'm missing something here.
permissions:
contents: read
What is the underlying problem you're trying to solve?
Hi, I'm Harshita. I’m working with CNCF and the Google Open Source Security Team for the GSoC 2024 term. We are collaborating to enhance security practices across various CNCF projects. The goal is to improve security for all CNCF projects by both using OpenSSF Scorecards and implementing its security improvements.
Describe the ideal solution
As this project already has scorecard action, I'm here to increase the final score by going over each check. I've listed all of the checks where work needs to be done, in order of its criticality. I plan to submit each PR for each fix. Please let me know what you think and for which ones a PR is welcome that I will submit it ASAP.
Current Score: 6.9
Scorecard report: https://scorecard.dev/viewer/?uri=github.com/open-policy-agent/opa
Here's a few checks we can work on to improve the project's security posture:
[ ] Signed-Releases: Score = 0
[X] Token-Permissions: Score = 0
[ ] Binary-Artifacts: Score = 4
[ ] Vulnerabilities: Score = 5
osv-scanner.toml
to mark some of these as not impacting/ignored.[ ] Pinned-Dependencies: Score = 8
/cc @joycebrum @diogoteles08 @pnacht @nate-double-u