Skip to content

Roll out OSSF scorecard workflow to all repositories #2636

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
trask opened this issue Mar 30, 2025 · 1 comment
Open

Roll out OSSF scorecard workflow to all repositories #2636

trask opened this issue Mar 30, 2025 · 1 comment
Labels
triage:accepted This issue has been accepted and will be worked.

Comments

@trask
Copy link
Member

trask commented Mar 30, 2025 •
edited
Loading

For an example of the report that this generates, see https://scorecard.dev/viewer/?uri=github.com/open-telemetry/opentelemetry-java-instrumentation

We are planning to use the scorecard report on Wednesday of this week to help drive a Security Slam event at KubeCon where participants can help to burn down our security backlog.

Note: this is using an automation mechanism similar to #2574 in order to send PRs to add these workflows to all repositories.
This was referenced Mar 30, 2025
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
This was referenced Mar 31, 2025
Merged
Merged
Merged
Merged
Merged
Merged
Open
Merged
Merged
Open
Merged
Open
Merged
Merged
Merged
Open
Merged
Merged
Open
Merged
Open
Merged
hdost pushed a commit to open-telemetry/opentelemetry-rust-contrib that referenced this issue Apr 1, 2025
@opentelemetrybot @otelbot
ci: Add ossf-scorecard scanning workflow (#230)
e069bd5 
See open-telemetry/community#2636 for details

Co-authored-by: otelbot <[email protected]>
@kaylareopelle
Copy link
Contributor

kaylareopelle commented Apr 1, 2025 •
edited
Loading

Thank you! I'm making one change for the Ruby repositories, to limit the runs to just the main fork so that contributor's forks don't get stuck with failing runs.

https://github.com/open-telemetry/opentelemetry-ruby/pull/1832/files#r2023374987

@trask trask pinned this issue Apr 2, 2025
@trask trask unpinned this issue Apr 2, 2025
jmacd added a commit to open-telemetry/otel-arrow that referenced this issue Apr 2, 2025
@opentelemetrybot @otelbot @jmacd
Add ossf-scorecard scanning workflow (#314)
7d88ffb 
See open-telemetry/community#2636 for details

---------

Co-authored-by: otelbot <[email protected]>
Co-authored-by: Joshua MacDonald <[email protected]>
@trask trask added the triage:accepted This issue has been accepted and will be worked. label Apr 8, 2025
@mx-psi mx-psi moved this to In Progress in GC Work May 5, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
triage:accepted This issue has been accepted and will be worked.
Projects
GC Work
Status: In Progress
Milestone
No milestone
Development

No branches or pull requests
2 participants
@trask @kaylareopelle