Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarify external workflow. Fixes #63 #103

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
+7 −5
Open

Clarify external workflow. Fixes #63 #103

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e312853
Clarify external workflow. Fixes #63
david-a-wheeler Dec 10, 2024
4a92f10
Update baseline.yaml
david-a-wheeler Dec 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions baseline.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,18 +129,20 @@ criteria:
maturity_level: 1
category: Build & Release
criteria: |
The project's build and release pipelines
MUST NOT execute arbitrary code that is
input from outside of the build script.
A project’s build process that either leads to release
or can read secret data MUST NOT execute untrusted external code.
david-a-wheeler marked this conversation as resolved.
Show resolved Hide resolved
objective: |
Reduce the risk of code injection or other
security vulnerabilities in the project's
build and release processes by restricting
the execution of external code.
the execution of external code in workflows.
implementation: |
Ensure that the project's build and release
pipelines do not execute arbitrary code
pipelines do not execute untrusted code
provided from external sources.
One approach is to only allow maintainers to identify
which external code can be used, using verification mechanisms
such as digital signatures or https.
control_mappings: # TODO
scorecard_probe:
- hasDangerousWorkflowScriptInjection
Expand Down
Loading