Skip to content

Commit 74baf48

Browse files
mmorel-35mmorel-35
committed
Setup scorecard workflow
Signed-off-by: Matthieu MOREL <[email protected]>
1 parent 81d15e9 commit 74baf48

File tree

4 files changed

+78
-36
lines changed

4 files changed

+78
-36
lines changed

‎.github/workflows/commands.yml

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,15 @@
11
name: commands
22
on:
33
issue_comment:
4-
types: [created]
5-
4+
types:
5+
- created
66
jobs:
77
retest:
88
if: github.repository == 'containernetworking/cni'
99
runs-on: ubuntu-latest
1010
steps:
1111
- name: Check out code
12-
uses: actions/checkout@v4
13-
12+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
1413
- name: Re-Test Action
1514
uses: ./.github/actions/retest-action
1615
with:

‎.github/workflows/scorecard.yml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Scorecard supply-chain security
2+
on:
3+
branch_protection_rule:
4+
push:
5+
branches:
6+
- main
7+
schedule:
8+
- cron: 29 15 * * 0
9+
permissions: read-all
10+
jobs:
11+
analysis:
12+
name: Scorecard analysis
13+
permissions:
14+
id-token: write
15+
security-events: write
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
20+
with:
21+
persist-credentials: false
22+
- name: Run analysis
23+
uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
24+
with:
25+
results_file: results.sarif
26+
results_format: sarif
27+
publish_results: true
28+
- name: Upload artifact
29+
uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
30+
with:
31+
name: SARIF file
32+
path: results.sarif
33+
retention-days: 5
34+
- name: Upload to code-scanning
35+
uses: github/codeql-action/upload-sarif@f0f3afee809481da311ca3a6ff1ff51d81dbeb24 # v3.26.4
36+
with:
37+
sarif_file: results.sarif

‎.github/workflows/test.yaml

Lines changed: 34 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,25 @@
1-
---
21
name: test
32

4-
on: ["push", "pull_request"]
3+
on:
4+
- push
5+
- pull_request
56

67
env:
7-
GO_VERSION: "1.22"
8-
LINUX_ARCHES: "amd64 386 arm arm64 s390x mips64le ppc64le"
8+
GO_VERSION: '1.22'
9+
LINUX_ARCHES: amd64 386 arm arm64 s390x mips64le ppc64le
910

1011
jobs:
11-
lint:
12-
name: Lint
13-
runs-on: ubuntu-latest
14-
steps:
15-
- name: setup go
16-
uses: actions/setup-go@v5
17-
with:
18-
go-version: ${{ env.GO_VERSION }}
19-
- uses: actions/checkout@v4
20-
- uses: ibiqlik/action-yamllint@v3
21-
with:
22-
format: auto
23-
- uses: golangci/golangci-lint-action@v6
24-
with:
25-
args: --verbose
26-
version: v1.57.1
12+
2713
build:
2814
name: Build all linux architectures
2915
needs: lint
3016
runs-on: ubuntu-latest
3117
steps:
3218
- name: setup go
33-
uses: actions/setup-go@v5
19+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32
3420
with:
3521
go-version: ${{ env.GO_VERSION }}
36-
- uses: actions/checkout@v4
37-
22+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
3823
- name: Build on all supported architectures
3924
run: |
4025
set -e
@@ -43,28 +28,45 @@ jobs:
4328
GOARCH=$arch go build ./...
4429
done
4530
31+
lint:
32+
name: Lint
33+
permissions:
34+
contents: read
35+
pull-requests: read
36+
runs-on: ubuntu-latest
37+
steps:
38+
- name: setup go
39+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
40+
with:
41+
go-version: ${{ env.GO_VERSION }}
42+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
43+
- uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3.1.1
44+
with:
45+
format: auto
46+
- uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # v6.1.0
47+
with:
48+
args: --verbose
49+
version: v1.57.1
50+
4651
test-linux:
4752
name: Run tests on Linux amd64
4853
needs: build
4954
runs-on: ubuntu-latest
5055
steps:
5156
- name: setup go
52-
uses: actions/setup-go@v5
57+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
5358
with:
5459
go-version: ${{ env.GO_VERSION }}
55-
- uses: actions/checkout@v4
56-
60+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
5761
- name: Install test binaries
5862
run: |
5963
go install github.com/mattn/[email protected]
6064
go install github.com/modocache/gover@latest
61-
6265
- name: test
6366
run: COVERALLS=1 ./test.sh
64-
65-
- name: Send coverage to coveralls
66-
env:
67+
- env:
6768
COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
69+
name: Send coverage to coveralls
6870
run: |
6971
PATH=$PATH:$(go env GOPATH)/bin
7072
gover
@@ -76,9 +78,9 @@ jobs:
7678
runs-on: windows-latest
7779
steps:
7880
- name: setup go
79-
uses: actions/setup-go@v5
81+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
8082
with:
8183
go-version: ${{ env.GO_VERSION }}
82-
- uses: actions/checkout@v4
84+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
8385
- name: test
8486
run: bash ./test.sh

‎README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@
44

55
# CNI - the Container Network Interface
66

7+
8+
[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/2446/badge)](https://bestpractices.coreinfrastructure.org/projects/2446)
9+
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/containernetworking/cni/badge)](https://securityscorecards.dev/viewer/?uri=github.com/containernetworking/cni)
10+
711
## What is CNI?
812

913
CNI (_Container Network Interface_), a [Cloud Native Computing Foundation](https://cncf.io) project, consists of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins.

0 commit comments

Comments
 (0)