Agent Wranglers

OSS-30Recommended

Run the OpenSSF Scorecard every week

Run the OpenSSF Scorecard on the repository every week and on every change to the CI files. Fail the job when a check of Critical or High risk scores below 10, unless the exception is written down.

By Agent Wranglers. Updated .

How to do it

Scorecard reads the repository and its settings and scores about 20 checks from 0 to 10. Examples are branch protection, code review, dangerous workflows, token permissions, pinned dependencies, signed releases and a security policy. Users and companies read the score when they choose what to depend on, as Review every new package describes. Each low check links to its fix. Many fixes are rules elsewhere, such as Keep secrets out of builds from strangers for workflows and Protect the main branch. Some checks do not fit every project, such as Packaging for a project that publishes no package. Write those exceptions in the repository with a reason. Scorecard is one example of such a check. The OSPS Baseline from OpenSSF lists the same controls by project maturity.

Examples

JavaScript example

const HIGH_RISK = ['Dangerous-Workflow', 'Webhooks', 'Binary-Artifacts', 'Branch-Protection', 'Code-Review',
  'Dependency-Update-Tool', 'Maintained', 'Signed-Releases', 'Token-Permissions', 'Vulnerabilities'];
const EXCEPTIONS = ['Maintained'];
const { checks } = await (await fetch('https://api.scorecard.dev/projects/github.com/example-shop/cart')).json();
const failing = checks.filter(check => HIGH_RISK.includes(check.name) && !EXCEPTIONS.includes(check.name) && check.score < 10);
if (failing.length) throw new Error(failing.map(check => `${check.name}: ${check.score} (${check.reason})`).join('\n'));

Python example

import json, urllib.request

HIGH_RISK = {"Dangerous-Workflow", "Webhooks", "Binary-Artifacts", "Branch-Protection", "Code-Review",
             "Dependency-Update-Tool", "Maintained", "Signed-Releases", "Token-Permissions", "Vulnerabilities"}
EXCEPTIONS = {"Maintained"}
report = json.load(urllib.request.urlopen("https://api.scorecard.dev/projects/github.com/example-shop/cart"))
failing = [c for c in report["checks"] if c["name"] in HIGH_RISK - EXCEPTIONS and c["score"] < 10]
assert not failing, "\n".join(f"{c['name']}: {c['score']} ({c['reason']})" for c in failing)

How to check

The weekly job, such as the Scorecard GitHub Action or a call to the public API, passes. Every Critical or High check scores 10 or is named in the written exception list.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/open-source/project-supply-chain/openssf-scorecard">Agent Wranglers open source maintenance playbook</a>. In code you write, add a comment next to it with the same link.