search

ossf / allstar

GitHub App to set and enforce security policies
Apache License 2.0
1.24k stars 123 forks source link

Update emitted copy around OpenSSF Scorecard checks #535

Open justaugustus opened 3 months ago

justaugustus commented 3 months ago

Using https://github.com/uwu-tools/ggreconcile/issues/8 as an example:

This issue was automatically created by Allstar.

Security Policy Violation Project is out of compliance with Security Scorecards policy

Rule Description This is a generic passthrough policy that runs the configured checks from Security Scorecards. Please see the Security Scorecards Documentation for more information on each check. The score was 0, and the passing threshold is 10. Results from policy: Branch-Protection : branch protection not enabled on development/release branches

* [0]:branch protection not enabled for branch 'main'

Results from policy: CI-Tests : 0 out of 2 merged PRs checked by a CI test -- score normalized to 0

* [0]:merged PR 4 without CI test at HEAD: [749a733](https://github.com/uwu-tools/ggreconcile/commit/749a733844dcab5f3b6a9f9acb3a5862face33c0)

* [0]:merged PR 2 without CI test at HEAD: [2464e9c](https://github.com/uwu-tools/ggreconcile/commit/2464e9c0236dc7f3738e22eb218b0c61f5e87b3e)

⚠️ There is an updated version of this policy result! Click here to see the latest update

This issue will auto resolve when the policy is in compliance.

Issue created by Allstar. See https://github.com/ossf/allstar/ for more information. For questions specific to the repository, please contact the owner or maintainer.

There are some things that likely need to be updated within the check's copy e.g., "Security Scorecards" should be "OpenSSF Scorecard" (ref: https://github.com/ossf/scorecard/issues/2427, https://github.com/ossf/scorecard/pull/2428)