[FEATURE] Security section in report for OSSF Scorecard

[eddiejaoude]

Description

There is an API to query results for the repo

https://github.com/ossf/scorecard?tab=readme-ov-file

Tasks

• docs: they must add the OSSF GitHub Action - can this be done with an api request from the app?
• check repo against the score card (there is a form, is there an API?)
• serverside: get+save API data as part of healthcheck run
• ui: display report results if exists

Resources

• report https://scorecard.dev/viewer/?uri=github.com/EddieHubCommunity/HealthCheck
• api https://api.scorecard.dev/projects/github.com/EddieHubCommunity/HealthCheck

Screenshots

No response

Additional information

No response

[eddiejaoude]

Example response

{
   "date":"2024-09-13T10:15:50Z",
   "repo":{
      "name":"github.com/EddieHubCommunity/HealthCheck",
      "commit":"a164cbfbb3ae601cdb0e09c748d4d28bd6e87e11"
   },
   "scorecard":{
      "version":"v4.13.1",
      "commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"
   },
   "score":5.6,
   "checks":[
      {
         "name":"Binary-Artifacts",
         "score":10,
         "reason":"no binaries found in the repo",
         "details":null,
         "documentation":{
            "short":"Determines if the project has generated executable (binary) artifacts in the source repository.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"
         }
      },
      {
         "name":"Branch-Protection",
         "score":0,
         "reason":"branch protection not enabled on development/release branches",
         "details":[
            "Warn: branch protection not enabled for branch 'main'"
         ],
         "documentation":{
            "short":"Determines if the default and release branches are protected with GitHub's branch protection settings.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"
         }
      },
      {
         "name":"CI-Tests",
         "score":9,
         "reason":"9 out of 10 merged PRs checked by a CI test -- score normalized to 9",
         "details":null,
         "documentation":{
            "short":"Determines if the project runs tests before pull requests are merged.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"
         }
      },
      {
         "name":"CII-Best-Practices",
         "score":0,
         "reason":"no effort to earn an OpenSSF best practices badge detected",
         "details":null,
         "documentation":{
            "short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"
         }
      },
      {
         "name":"Code-Review",
         "score":0,
         "reason":"found 20 unreviewed changesets out of 20 -- score normalized to 0",
         "details":null,
         "documentation":{
            "short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"
         }
      },
      {
         "name":"Contributors",
         "score":10,
         "reason":"13 different organizations found -- score normalized to 10",
         "details":[
            "Info: contributors work for EddieHubCommunity,GitHub-Stars,Profiden,Youth-Icon,darkmash-org,inofy,kubernetes,kubernetes-client,kubernetes-csi,kubernetes-sigs,mediasyntax,open source engineer,sabagroup"
         ],
         "documentation":{
            "short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"
         }
      },
      {
         "name":"Dangerous-Workflow",
         "score":10,
         "reason":"no dangerous workflow patterns detected",
         "details":null,
         "documentation":{
            "short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"
         }
      },
      {
         "name":"Dependency-Update-Tool",
         "score":10,
         "reason":"update tool detected",
         "details":[
            "Info: tool 'Dependabot' is used: .github/dependabot.yml:1"
         ],
         "documentation":{
            "short":"Determines if the project uses a dependency update tool.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"
         }
      },
      {
         "name":"Fuzzing",
         "score":0,
         "reason":"project is not fuzzed",
         "details":[
            "Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)",
            "Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)",
            "Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)",
            "Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)",
            "Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)",
            "Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)",
            "Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)",
            "Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)",
            "Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)",
            "Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)",
            "Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)",
            "Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)",
            "Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"
         ],
         "documentation":{
            "short":"Determines if the project uses fuzzing.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"
         }
      },
      {
         "name":"License",
         "score":10,
         "reason":"license file detected",
         "details":[
            "Info: License file found in expected location: LICENSE:1",
            "Info: FSF or OSI recognized license: LICENSE:1"
         ],
         "documentation":{
            "short":"Determines if the project has defined a license.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"
         }
      },
      {
         "name":"Maintained",
         "score":0,
         "reason":"repo was created 67 days ago, not enough maintenance history",
         "details":[
            "Warn: repo was created in the last 90 days (Created at: 2024-07-07T13:11:06Z), please review its contents carefully"
         ],
         "documentation":{
            "short":"Determines if the project is \"actively maintained\".",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"
         }
      },
      {
         "name":"Packaging",
         "score":10,
         "reason":"publishing workflow detected",
         "details":[
            "Info: GitHub/GitLab publishing workflow used in run https://api.github.com/repos/EddieHubCommunity/HealthCheck/actions/runs/10844380566: .github/workflows/docker.yml:28"
         ],
         "documentation":{
            "short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"
         }
      },
      {
         "name":"Pinned-Dependencies",
         "score":3,
         "reason":"dependency not pinned by hash detected -- score normalized to 3",
         "details":[
            "Warn: third-party GitHubAction not pinned by hash: .github/workflows/checks.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/checks.yml/main?enable=pin",
            "Warn: third-party GitHubAction not pinned by hash: .github/workflows/deploy.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/deploy.yml/main?enable=pin",
            "Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/deploy.yml/main?enable=pin",
            "Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/deploy.yml/main?enable=pin",
            "Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
            "Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
            "Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
            "Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
            "Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
            "Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
            "Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
            "Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/docker.yml/main?enable=pin",
            "Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/lint.yml/main?enable=pin",
            "Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/lint.yml/main?enable=pin",
            "Warn: third-party GitHubAction not pinned by hash: .github/workflows/lint.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/lint.yml/main?enable=pin",
            "Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/playwright.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/playwright.yml/main?enable=pin",
            "Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/playwright.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/playwright.yml/main?enable=pin",
            "Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/release.yml/main?enable=pin",
            "Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/release.yml/main?enable=pin",
            "Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/release.yml/main?enable=pin",
            "Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/scorecard.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/scorecard.yml/main?enable=pin",
            "Warn: containerImage not pinned by hash: Dockerfile:3",
            "Warn: containerImage not pinned by hash: Dockerfile:17",
            "Warn: containerImage not pinned by hash: Dockerfile.dev:2",
            "Info:   2 out of  14 GitHub-owned GitHubAction dependencies pinned",
            "Info:   1 out of  10 third-party GitHubAction dependencies pinned",
            "Info:   0 out of   3 containerImage dependencies pinned",
            "Info:   7 out of   7 npmCommand dependencies pinned"
         ],
         "documentation":{
            "short":"Determines if the project has declared and pinned the dependencies of its build process.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"
         }
      },
      {
         "name":"SAST",
         "score":9,
         "reason":"SAST tool is not run on all commits -- score normalized to 9",
         "details":[
            "Warn: 18 commits out of 20 are checked with a SAST tool",
            "Warn: CodeQL tool not detected"
         ],
         "documentation":{
            "short":"Determines if the project uses static code analysis.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"
         }
      },
      {
         "name":"Security-Policy",
         "score":9,
         "reason":"security policy file detected",
         "details":[
            "Info: security policy file detected: SECURITY.MD:1",
            "Info: Found linked content: SECURITY.MD:1",
            "Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)",
            "Info: Found text in security policy: SECURITY.MD:1"
         ],
         "documentation":{
            "short":"Determines if the project has published a security policy.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"
         }
      },
      {
         "name":"Signed-Releases",
         "score":-1,
         "reason":"no releases found",
         "details":[
            "Warn: no GitHub releases found"
         ],
         "documentation":{
            "short":"Determines if the project cryptographically signs release artifacts.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"
         }
      },
      {
         "name":"Token-Permissions",
         "score":0,
         "reason":"detected GitHub workflow tokens with excessive permissions",
         "details":[
            "Info: topLevel permissions set to 'read-all': .github/workflows/checks.yml:2",
            "Info: topLevel permissions set to 'read-all': .github/workflows/deploy.yml:2",
            "Info: topLevel permissions set to 'read-all': .github/workflows/docker.yml:2",
            "Warn: no topLevel permission defined: .github/workflows/lint.yml:1: Visit https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/lint.yml/main?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)",
            "Warn: no topLevel permission defined: .github/workflows/playwright.yml:1: Visit https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/playwright.yml/main?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)",
            "Warn: no topLevel permission defined: .github/workflows/release.yml:1: Visit https://app.stepsecurity.io/secureworkflow/EddieHubCommunity/HealthCheck/release.yml/main?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)",
            "Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:18",
            "Info: no jobLevel write permissions found"
         ],
         "documentation":{
            "short":"Determines if the project's workflows follow the principle of least privilege.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"
         }
      },
      {
         "name":"Vulnerabilities",
         "score":9,
         "reason":"1 existing vulnerabilities detected",
         "details":[
            "Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j"
         ],
         "documentation":{
            "short":"Determines if the project has open, known unfixed vulnerabilities.",
            "url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"
         }
      }
   ]
}