From c342891f3e2544f825769ceae5ccd79f0bef5475 Mon Sep 17 00:00:00 2001 From: Joyce Brum Date: Thu, 8 Dec 2022 19:06:38 +0000 Subject: [PATCH] Squashed commit of the following: commit 72293cbe879bcd1fff610eace6929922c4a4d668 Author: Joyce Brum Date: Thu Nov 3 10:20:52 2022 -0300 fix: upgrade scorecard action to 2.0.6 Signed-off-by: Joyce Brum commit 39451ef36f4ce71053c59c3a238d95752be05136 Author: Joyce Date: Wed Sep 14 17:52:59 2022 -0300 Change to the original repository Signed-off-by: Joyce Signed-off-by: Joyce Brum commit ddcccaa14b8ef928a4bc8ba38429d8a442806ae9 Author: Joyce Date: Wed Sep 14 17:51:26 2022 -0300 Add scorecard badge Signed-off-by: Joyce Signed-off-by: Joyce Brum commit 8ac265f0ee197e30862c0510b01dce2bc350e129 Author: Joyce Date: Wed Sep 14 17:49:49 2022 -0300 Configure Scorecard action 2.0.3 Signed-off-by: Joyce Signed-off-by: Joyce Brum --- .github/workflows/scorecards.yml | 54 ++++++++++++++++++++++++++++++++ README.md | 4 +-- 2 files changed, 56 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/scorecards.yml diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml new file mode 100644 index 000000000..d9e63e54d --- /dev/null +++ b/.github/workflows/scorecards.yml @@ -0,0 +1,54 @@ +name: Scorecards supply-chain security +on: + # Only the default branch is supported. + branch_protection_rule: + schedule: + - cron: '44 9 * * 4' + push: + branches: [ "v2" ] + +# Declare default permissions as read only. +permissions: read-all + +jobs: + analysis: + name: Scorecards analysis + runs-on: ubuntu-latest + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + # Used to receive a badge. + id-token: write + + steps: + - name: "Checkout code" + uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@99c53751e09b9529366343771cc321ec74e9bd3d # tag=v2.0.6 + with: + results_file: results.sarif + results_format: sarif + + # Publish the results for public repositories to enable scorecard badges. For more details, see + # https://github.com/ossf/scorecard-action#publishing-results. + # For private repositories, `publish_results` will automatically be set to `false`, regardless + # of the value entered here. + publish_results: true + + # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF + # format to the repository Actions tab. + - name: "Upload artifact" + uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # tag=v3.0.0 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard. + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26 + with: + sarif_file: results.sarif diff --git a/README.md b/README.md index b321a7c07..b6075af36 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ [![Build Status](https://img.shields.io/github/workflow/status/docker/compose/ci?label=ci&logo=github&style=flat-square)](https://github.com/docker/compose/actions?query=workflow%3Aci) [![Go Report Card](https://goreportcard.com/badge/github.com/docker/compose/v2?style=flat-square)](https://goreportcard.com/report/github.com/docker/compose/v2) [![Codecov](https://codecov.io/gh/docker/compose/branch/master/graph/badge.svg?token=HP3K4Y4ctu)](https://codecov.io/gh/docker/compose) - +[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/docker/compose/badge)](https://api.securityscorecards.dev/projects/github.com/docker/compose) ![Docker Compose](logo.png?raw=true "Docker Compose Logo") Docker Compose is a tool for running multi-container applications on Docker @@ -42,7 +42,7 @@ for Windows and macOS. You can download Docker Compose binaries from the [release page](https://github.com/docker/compose/releases) on this repository. -Rename the relevant binary for your OS to `docker-compose` and copy it to `$HOME/.docker/cli-plugins` +Rename the relevant binary for your OS to `docker-compose` and copy it to `$HOME/.docker/cli-plugins` Or copy it into one of these folders to install it system-wide: