From 791691c2d7e016851303aab67be055bf6dd17e89 Mon Sep 17 00:00:00 2001 From: Pedro Nacht <15221358+pnacht@users.noreply.github.com> Date: Tue, 13 Sep 2022 19:22:39 -0300 Subject: [PATCH 1/7] Create scorecards.yml --- .github/workflows/scorecards.yml | 52 ++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 .github/workflows/scorecards.yml diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml new file mode 100644 index 0000000000000..40efb25427bce --- /dev/null +++ b/.github/workflows/scorecards.yml @@ -0,0 +1,52 @@ +name: Scorecards supply-chain security +on: + # Only the default branch is supported. + branch_protection_rule: + schedule: + - cron: '27 19 * * 4' + push: + branches: [ "main" ] + +# Declare default permissions as read only. +permissions: read-all + +jobs: + analysis: + name: Scorecards analysis + runs-on: ubuntu-latest + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + # Used to receive a badge. + # id-token: write + + steps: + - name: "Checkout code" + uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@865b4092859256271290c77adbd10a43f4779972 # tag=v2.0.3 + with: + results_file: results.sarif + results_format: sarif + + # Publish the results for public repositories to enable scorecard badges. For more details, see + # https://github.com/ossf/scorecard-action#publishing-results. + publish_results: true + + # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF + # format to the repository Actions tab. + - name: "Upload artifact" + uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3.1.0 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard. + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26 + with: + sarif_file: results.sarif From 9dc12f53d2eb64489aa4b5a7a3d88c8cca1ecf3e Mon Sep 17 00:00:00 2001 From: Pedro Nacht <15221358+pnacht@users.noreply.github.com> Date: Wed, 14 Sep 2022 10:29:58 -0300 Subject: [PATCH 2/7] Update scorecards.yml --- .github/workflows/scorecards.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 40efb25427bce..d80fd7f8c9919 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -18,7 +18,7 @@ jobs: # Needed to upload the results to code-scanning dashboard. security-events: write # Used to receive a badge. - # id-token: write + id-token: write steps: - name: "Checkout code" From ba27970821ff29f6c9e99442b1bf4163e9622ba7 Mon Sep 17 00:00:00 2001 From: Pedro Nacht <15221358+pnacht@users.noreply.github.com> Date: Thu, 15 Sep 2022 14:23:27 -0300 Subject: [PATCH 3/7] Add OpenSSF Scorecards badge to README.md --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index aaf63ead9c416..6ec871d46c782 100644 --- a/README.md +++ b/README.md @@ -11,6 +11,7 @@ [![Package Status](https://img.shields.io/pypi/status/pandas.svg)](https://pypi.org/project/pandas/) [![License](https://img.shields.io/pypi/l/pandas.svg)](https://github.com/pandas-dev/pandas/blob/main/LICENSE) [![Coverage](https://codecov.io/github/pandas-dev/pandas/coverage.svg?branch=main)](https://codecov.io/gh/pandas-dev/pandas) +[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/pandas-dev/pandas/badge)](https://api.securityscorecards.dev/projects/github.com/pandas-dev/pandas) [![Downloads](https://static.pepy.tech/personalized-badge/pandas?period=month&units=international_system&left_color=black&right_color=orange&left_text=PyPI%20downloads%20per%20month)](https://pepy.tech/project/pandas) [![Gitter](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/pydata/pandas) [![Powered by NumFOCUS](https://img.shields.io/badge/powered%20by-NumFOCUS-orange.svg?style=flat&colorA=E1523D&colorB=007D8A)](https://numfocus.org) From 4775dedf6953ed62f2edbb1a1ea97ad1ecef9e6a Mon Sep 17 00:00:00 2001 From: Pedro Nacht <15221358+pnacht@users.noreply.github.com> Date: Thu, 15 Sep 2022 15:28:54 -0300 Subject: [PATCH 4/7] Trim whitespace in scorecards.yml --- .github/workflows/scorecards.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index d80fd7f8c9919..dcfdf55b8bfdf 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -19,7 +19,7 @@ jobs: security-events: write # Used to receive a badge. id-token: write - + steps: - name: "Checkout code" uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 @@ -33,7 +33,7 @@ jobs: results_format: sarif # Publish the results for public repositories to enable scorecard badges. For more details, see - # https://github.com/ossf/scorecard-action#publishing-results. + # https://github.com/ossf/scorecard-action#publishing-results. publish_results: true # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF @@ -44,7 +44,7 @@ jobs: name: SARIF file path: results.sarif retention-days: 5 - + # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26 From 6e2aac8d0acd94833ff3aa06112894621270102f Mon Sep 17 00:00:00 2001 From: Pedro Nacht <15221358+pnacht@users.noreply.github.com> Date: Fri, 16 Sep 2022 16:37:30 -0300 Subject: [PATCH 5/7] Skip scorecards.yml on forks --- .github/workflows/scorecards.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index dcfdf55b8bfdf..74db12db360ca 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -19,6 +19,8 @@ jobs: security-events: write # Used to receive a badge. id-token: write + + if: github.repository == 'pandas-dev/pandas' # don't run on forks steps: - name: "Checkout code" From 6e304d62462a0263e9d04a233243107d27a8e1a0 Mon Sep 17 00:00:00 2001 From: Pedro Nacht <15221358+pnacht@users.noreply.github.com> Date: Fri, 16 Sep 2022 16:56:00 -0300 Subject: [PATCH 6/7] Fix whitespace --- .github/workflows/scorecards.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 74db12db360ca..0ce998808e2d0 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -19,7 +19,7 @@ jobs: security-events: write # Used to receive a badge. id-token: write - + if: github.repository == 'pandas-dev/pandas' # don't run on forks steps: From fabc385dcf0175ea65079b81a7cdfe664f40da97 Mon Sep 17 00:00:00 2001 From: Pedro Nacht <15221358+pnacht@users.noreply.github.com> Date: Mon, 19 Sep 2022 19:56:04 -0300 Subject: [PATCH 7/7] Pin scorecards.yml dependencies to major versions --- .github/workflows/scorecards.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 0ce998808e2d0..7799c33b66683 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -24,12 +24,12 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + uses: actions/checkout@v3 with: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@865b4092859256271290c77adbd10a43f4779972 # tag=v2.0.3 + uses: ossf/scorecard-action@v2 with: results_file: results.sarif results_format: sarif @@ -41,7 +41,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3.1.0 + uses: actions/upload-artifact@v3 with: name: SARIF file path: results.sarif @@ -49,6 +49,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26 + uses: github/codeql-action/upload-sarif@v1 with: sarif_file: results.sarif