Add OpenSSF Scorecard (#141)

nginxinc · Aug 2, 2023 · 17fc1a7 · 17fc1a7
1 parent c4cd100
commit 17fc1a7
Show file tree

Hide file tree

Showing 2 changed files with 88 additions and 11 deletions.
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -0,0 +1,61 @@
+name: OpenSSF Scorecards
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "42 15 * * 6" # run every Saturday at 15:42 UTC
+  push:
+    branches:
+      - main
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@08b4669551908b1024bb425080c797723083c031 # v2.2.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@0ba4244466797eb048eb91a6cd43d5c03ca8bd05 # v2.21.2
+        with:
+          sarif_file: results.sarif
diff --git a/README.md b/README.md
@@ -1,17 +1,27 @@
 
-[![Continuous Integration](https://github.com/nginxinc/nginx-plus-go-client/workflows/Continuous%20Integration/badge.svg)](https://github.com/nginxinc/nginx-plus-go-client/actions)  [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)  [![Go Report Card](https://goreportcard.com/badge/github.com/nginxinc/nginx-plus-go-client)](https://goreportcard.com/report/github.com/nginxinc/nginx-plus-go-client)  [![FOSSA Status](https://app.fossa.com/api/projects/custom%2B5618%2Fgithub.com%2Fnginxinc%2Fnginx-plus-go-client.svg?type=shield)](https://app.fossa.com/projects/custom%2B5618%2Fgithub.com%2Fnginxinc%2Fnginx-plus-go-client?ref=badge_shield)  [![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/nginxinc/nginx-plus-go-client?logo=github&sort=semver)](https://github.com/nginxinc/nginx-plus-go-client/releases/latest)  ![GitHub go.mod Go version](https://img.shields.io/github/go-mod/go-version/nginxinc/nginx-plus-go-client?logo=go) [![Slack](https://img.shields.io/badge/slack-nginxcommunity-green?logo=slack)](https://nginxcommunity.slack.com)
+<!-- markdownlint-disable-next-line first-line-h1 -->
+[![OpenSSFScorecard](https://api.securityscorecards.dev/projects/github.com/nginxinc/nginx-plus-go-client/badge)](https://api.securityscorecards.dev/projects/github.com/nginxinc/nginx-plus-go-client)
+[![Continuous Integration](https://github.com/nginxinc/nginx-plus-go-client/workflows/Continuous%20Integration/badge.svg)](https://github.com/nginxinc/nginx-plus-go-client/actions)
+[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
+[![Go Report Card](https://goreportcard.com/badge/github.com/nginxinc/nginx-plus-go-client)](https://goreportcard.com/report/github.com/nginxinc/nginx-plus-go-client)
+[![FOSSA Status](https://app.fossa.com/api/projects/custom%2B5618%2Fgithub.com%2Fnginxinc%2Fnginx-plus-go-client.svg?type=shield)](https://app.fossa.com/projects/custom%2B5618%2Fgithub.com%2Fnginxinc%2Fnginx-plus-go-client?ref=badge_shield)
+[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/nginxinc/nginx-plus-go-client?logo=github&sort=semver)](https://github.com/nginxinc/nginx-plus-go-client/releases/latest)
+![GitHub go.mod Go version](https://img.shields.io/github/go-mod/go-version/nginxinc/nginx-plus-go-client?logo=go)
+[![Slack](https://img.shields.io/badge/slack-nginxcommunity-green?logo=slack)](https://nginxcommunity.slack.com)
 
 # NGINX Plus Go Client
 
 This project includes a client library for working with NGINX Plus API.
 
 ## About the Client
 
-`client/nginx.go` includes functions and data structures for working with NGINX Plus API as well as some helper functions.
+`client/nginx.go` includes functions and data structures for working with NGINX Plus API as well as some helper
+functions.
 
 ## Compatibility
 
-This Client works against versions 4 to 8 of the NGINX Plus API. The table below shows the version of NGINX Plus where the API was first introduced.
+This Client works against versions 4 to 8 of the NGINX Plus API. The table below shows the version of NGINX Plus where
+the API was first introduced.
 
 | API version | NGINX Plus version |
 |-------------|--------------------|
@@ -29,35 +39,41 @@ This Client works against versions 4 to 8 of the NGINX Plus API. The table below
 ## Testing
 
 ### Unit tests
-```
-$ cd client
-$ go test
+
+```console
+cd client
+go test
 ```
 
 ### Integration tests
 
 Prerequisites:
+
 * Docker
 * golang
 * Make
 * NGINX Plus license - put `nginx-repo.crt` and `nginx-repo.key` into the `docker` folder.
 
 Run Tests:
 
-```
-$ make docker-build && make test
+```console
+make docker-build && make test
 ```
 
-This will build and run two NGINX Plus containers and create one docker network of type bridge, execute the client tests against both NGINX Plus APIs, and then clean up. If it fails and you want to clean up (i.e. stop the running containers and remove the docker network), please use `$ make clean`
+This will build and run two NGINX Plus containers and create one docker network of type bridge, execute the client tests
+against both NGINX Plus APIs, and then clean up. If it fails and you want to clean up (i.e. stop the running containers
+and remove the docker network), please use `make clean`
 
 ## Contacts
 
-We’d like to hear your feedback! If you have any suggestions or experience issues with the NGINX Plus Go Client, please create an issue or send a pull request on GitHub.
-You can contact us directly via [email protected] or on the [NGINX Community Slack](https://nginxcommunity.slack.com).
+We’d like to hear your feedback! If you have any suggestions or experience issues with the NGINX Plus Go Client, please
+create an issue or send a pull request on GitHub. You can contact us directly via <[email protected]> or on the
+[NGINX Community Slack](https://nginxcommunity.slack.com).
 
 ## Contributing
 
 If you'd like to contribute to the project, please read our [Contributing guide](CONTRIBUTING.md).
 
 ## Support
+
 This project is not covered by the NGINX Plus support contract.