Include OSSF Scorecard analysis using containers

[UlisesGascon]

Main Changes

• Add dependency @ulisesgascon/[email protected] (3b299f1)
• Add JSON Schema validations for the OpenSSF Scorecard results (42e905d and 772481f)
• Add OSSF provider (1ecd406)
• Add workflow upsert-ossf-scorecard (3dfdc65)

Other Changes

• Add a sample fixture for OSSF Scorecard response (b01b9fd)
• Add OpenSSF scorecard records to the seed script (326a584)
• Extend test utils to support ossf scorecard operations (c9741e6)
• Extend configuration to support OSSF Scorecard (6b06409)
• Extend the store to support OSSF Scorecard operations (1c55a87)
• Add todos for run upsert-ossf-scorecard testing (8e2ac1d)
• Add analysis_execution_time in the OSSF Scorecard mapper (1cdc09f)
• Make the OSSF Scorecard analysis more resilient (065966b)
• Lint files (6f6d0bb and 513a28a)

Screenshots

The execution worked fine for many repositories (Express Project with 3 Github Orgs):

The table also includes the column analysis_execution_time that stores the execution time for each analysis, this will help us to know how to distribute this workload in the future. Currently, after few executions the slowest process is under 30s, the faster ones around 5s.

Context

• close Add workflow upsert-ossf-scorecard #60

Changelog

• 3b299f1 chore: add dependency @ulisesgascon/[email protected] by @UlisesGascon
• b01b9fd feat: add a sample fixture for OSSF Scorecard response by @UlisesGascon
• 326a584 feat: add OpenSSF scorecards records to the seed script by @UlisesGascon
• c9741e6 test: extend utils to support ossf scorecard operations by @UlisesGascon
• 6b06409 feat: extend configuration to support OSSF Scorecard by @UlisesGascon
• 42e905d feat: add JSON Schema validations for the OpenSSF Scorecard results by @UlisesGascon
• 772481f feat: improve OSSF Scorecard result schema by @UlisesGascon
• 1ecd406 feat: add OSSF provider by @UlisesGascon
• 1c55a87 feat: extend the store to support OSSF Scorecard operations by @UlisesGascon
• 3dfdc65 feat: add workflow upsert-ossf-scorecard by @UlisesGascon
• 6f6d0bb chore: lint files by @UlisesGascon
• 8e2ac1d test: add todo for run upsert-ossf-scorecard by @UlisesGascon
• 1cdc09f fix: add analysis_execution_time in the OSSF Scorecard mapper by @UlisesGascon
• 065966b chore: make the OSSF Scorecard analysis more resilient by @UlisesGascon
• 513a28a chore: lint files by @UlisesGascon

[socket-security]

New dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@ulisesgascon/[email protected]	None	0	8.25 kB	ulisesgascon

View full report↗︎