Skip to content

Commit 635c9ff

Browse files
sureshmarikkannusureshmarikkannu
authored
Add GHA for scorecard analysis (OpenSSF) (#66)
Signed-off-by: Marikkannu, Suresh <[email protected]>
1 parent 6531a05 commit 635c9ff

File tree

6 files changed

+150
-9
lines changed

6 files changed

+150
-9
lines changed

‎.github/CODEOWNERS‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# SPDX-FileCopyrightText: 2025 Intel Corporation
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
* @omec-project/5gc-maintainers

‎.github/dependabot.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,11 @@ updates:
1919
day: "wednesday"
2020
time: "21:00"
2121
timezone: "America/Los_Angeles"
22+
23+
- package-ecosystem: github-actions
24+
directory: /
25+
schedule:
26+
interval: "weekly"
27+
day: "wednesday"
28+
time: "21:00"
29+
timezone: "America/Los_Angeles"

‎.github/workflows/main.yml‎

Lines changed: 56 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,31 +11,82 @@ on:
1111
branches:
1212
- main
1313

14+
permissions:
15+
contents: read
16+
1417
jobs:
1518
doc8:
16-
uses: omec-project/.github/.github/workflows/make-target-reuse.yml@main
19+
permissions:
20+
contents: read
21+
actions: read
22+
security-events: write
23+
id-token: write
24+
attestations: write
25+
uses: omec-project/.github/.github/workflows/make-target-reuse.yml@453e42d23f0366133ec7c053ee92a97f374f3ac5 # v0.0.1
1726
with:
1827
branch_name: ${{ github.ref }}
1928
target: doc8
2029

2130
spell-check:
22-
uses: omec-project/.github/.github/workflows/make-target-reuse.yml@main
31+
permissions:
32+
contents: read
33+
checks: write
34+
id-token: write
35+
attestations: write
36+
uses: omec-project/.github/.github/workflows/make-target-reuse.yml@453e42d23f0366133ec7c053ee92a97f374f3ac5 # v0.0.1
2337
with:
2438
branch_name: ${{ github.ref }}
2539
target: spelling
2640

2741
link-check:
28-
uses: omec-project/.github/.github/workflows/make-target-reuse.yml@main
42+
permissions:
43+
contents: read
44+
checks: write
45+
id-token: write
46+
attestations: write
47+
uses: omec-project/.github/.github/workflows/make-target-reuse.yml@453e42d23f0366133ec7c053ee92a97f374f3ac5 # v0.0.1
2948
with:
3049
branch_name: ${{ github.ref }}
3150
target: linkcheck
3251

3352
license-check:
34-
uses: omec-project/.github/.github/workflows/license-check.yml@main
53+
permissions:
54+
contents: read
55+
id-token: write
56+
attestations: write
57+
uses: omec-project/.github/.github/workflows/license-check.yml@453e42d23f0366133ec7c053ee92a97f374f3ac5 # v0.0.1
3558
with:
3659
branch_name: ${{ github.ref }}
3760

3861
fossa-scan:
39-
uses: omec-project/.github/.github/workflows/fossa-scan.yml@main
62+
permissions:
63+
contents: read
64+
security-events: write
65+
id-token: write
66+
attestations: write
67+
uses: omec-project/.github/.github/workflows/fossa-scan.yml@453e42d23f0366133ec7c053ee92a97f374f3ac5 # v0.0.1
68+
with:
69+
branch_name: ${{ github.ref }}
70+
71+
analysis:
72+
if: github.repository_owner == 'omec-project'
73+
permissions:
74+
actions: read
75+
artifact-metadata: read
76+
attestations: read
77+
checks: read
78+
contents: read
79+
deployments: read
80+
discussions: read
81+
id-token: write
82+
issues: read
83+
models: read
84+
packages: read
85+
pages: read
86+
pull-requests: read
87+
repository-projects: read
88+
security-events: write
89+
statuses: read
90+
uses: omec-project/.github/.github/workflows/scorecard-analysis.yml@453e42d23f0366133ec7c053ee92a97f374f3ac5 # v0.0.1
4091
with:
4192
branch_name: ${{ github.ref }}

‎.github/workflows/push.yml‎

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,27 +9,47 @@ on:
99
- main
1010
workflow_dispatch:
1111

12+
permissions:
13+
contents: read
14+
1215
jobs:
1316
validate:
14-
uses: omec-project/.github/.github/workflows/validate.yml@main
17+
permissions:
18+
contents: write
19+
actions: read
20+
id-token: write
21+
uses: omec-project/.github/.github/workflows/validate.yml@453e42d23f0366133ec7c053ee92a97f374f3ac5 # v0.0.1
1522
with:
1623
branch_name: ${{ github.ref }}
1724

1825
tag-github:
19-
uses: omec-project/.github/.github/workflows/tag-github.yml@main
26+
permissions:
27+
contents: write
28+
actions: read
29+
id-token: write
30+
uses: omec-project/.github/.github/workflows/tag-github.yml@453e42d23f0366133ec7c053ee92a97f374f3ac5 # v0.0.1
2031
secrets: inherit
2132

2233
update-version:
2334
needs: tag-github
24-
uses: omec-project/.github/.github/workflows/update-version.yml@main
35+
permissions:
36+
contents: write
37+
pull-requests: write
38+
actions: read
39+
id-token: write
40+
uses: omec-project/.github/.github/workflows/update-version.yml@453e42d23f0366133ec7c053ee92a97f374f3ac5 # v0.0.1
2541
with:
2642
changed: ${{ needs.tag-github.outputs.changed }}
2743
version: ${{ needs.tag-github.outputs.version }}
2844
secrets: inherit
2945

3046
publish:
3147
if: github.repository_owner == 'omec-project'
32-
uses: omec-project/.github/.github/workflows/publish-docs.yml@main
48+
permissions:
49+
contents: write
50+
actions: read
51+
id-token: write
52+
uses: omec-project/.github/.github/workflows/publish-docs.yml@453e42d23f0366133ec7c053ee92a97f374f3ac5 # v0.0.1
3353
secrets: inherit
3454
with:
3555
branch_name: ${{ github.ref }}

‎.pre-commit-config.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# SPDX-FileCopyrightText: 2025 Intel Corporation
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
repos:
5+
- repo: https://github.com/gitleaks/gitleaks
6+
rev: v8.29.0
7+
hooks:
8+
- id: gitleaks
9+
- repo: https://github.com/golangci/golangci-lint
10+
rev: v2.6.1
11+
hooks:
12+
- id: golangci-lint
13+
- repo: https://github.com/pre-commit/pre-commit-hooks
14+
rev: v6.0.0
15+
hooks:
16+
- id: end-of-file-fixer
17+
- id: trailing-whitespace

‎docs/SECURITY.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
<!--
2+
SPDX-FileCopyrightText: 2025 Intel Corporation
3+
SPDX-License-Identifier: Apache-2.0
4+
-->
5+
# Security Policy
6+
7+
## Supported Versions
8+
9+
We release patches for security vulnerabilities in the following versions:
10+
11+
| Version | Supported |
12+
| ------- | ------------------ |
13+
| 1.x.x | :white_check_mark: |
14+
15+
## Reporting a Vulnerability
16+
17+
If you discover a security vulnerability, please:
18+
19+
1. **DO NOT** create a public GitHub issue
20+
2. Email us at: [email protected]
21+
3. Include detailed information about the vulnerability
22+
4. Allow us reasonable time to address the issue before public disclosure
23+
24+
### What to Include
25+
26+
- Description of the vulnerability
27+
- Steps to reproduce the issue
28+
- Potential impact assessment
29+
- Any proof-of-concept code (if applicable)
30+
31+
## Security Best Practices
32+
33+
When using this project:
34+
- Keep dependencies up to date
35+
- Use the latest supported version
36+
- Follow secure coding practices
37+
- Regularly audit your implementation
38+
39+
## Contact
40+
41+
1. #sdcore-dev channel in [Aether Community Slack](https://aether5g-project.slack.com)

0 commit comments

Comments
 (0)