CI: adds Plumber workflow security check - #2493
Closed
Totara-thib wants to merge 1 commit into
Closed
Conversation
Runs the Plumber CLI on pushes to dev and master and on pull requests. It statically checks the workflows under .github/workflows for supply chain risks (unpinned third-party actions, missing token permission scopes, secrets handed to workflows that do not need them) and uploads a SARIF report so findings show up in the Security tab. The gate passes at 85 of 100 points, so one small finding does not block PRs. The .plumber.yaml overlay inherits the tool's built-in baseline and only records what differs for this repo: the niche platform actions the BSD, Solaris and arch-emulation builds rely on are trusted on top of the curated default source list. The README badge works like OpenSSF Scorecard's published results and shows the current score of the default branch.
Member
|
So this is basically an ad. No. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Companion to #2492, merge that one first: the check added here flags the unpinned actions, the shared secrets and the missing permission scopes until the hardening lands, then it goes green.
This adds Plumber to CI, the tool I used to find those issues in the first place. It scans the workflows on each push to dev/master and on each PR, and fails when something regresses: an unpinned action, a job without a permissions block, a secret handed to a workflow that does not need it, that kind of thing. The gate passes at 85 of 100 points, so one small finding does not block your PRs.
plumber.yml: pinned by sha, minimal permissions, findings go to the Security tab as SARIF (skipped on PRs from forks, the report stays as a workflow artifact there)..plumber.yaml: a small overlay that inherits the tool's built-in baseline; the only thing written is what differs for this repo, the niche platform actions your BSD, Solaris and arch-emulation builds rely on are trusted on top of the curated default source list. Everything else, including new controls in future releases, follows the defaults automatically.README.md: one line, the score badge next to the existing ones.Score badge
I enabled
score-pushon the action. It works like OpenSSF Scorecard's published results: every run, on any branch, publishes the score to score.getplumber.io, and that feeds the badge in the README. Scores are public and the badge always shows the state of the default branch. A failed publish never fails your CI. Until the first run the badge reads UNKNOWN in gray, then it flips to the grade. If you would rather not have it, drop the README line and thescore-pushinput, the rest works the same.With the hardening in, this runs green with a score of A. Set
soft-fail: trueif you prefer report only, without gating PRs.To be fully transparent: I work on Plumber. If you do not want the tool in your CI, no hard feelings, say so and I close this PR, the hardening PR stands on its own.
Related issue (required for new logos for new distros)
Not a logo PR, no related issue.
Changes
Screenshots
No visual changes.
Checklist