Improve score on OpenSSF scorecard #450

Activity

1. mhdawson

   added this to the Milestone 11 milestone on Apr 13, 2023
2. mhdawson commented on Jun 30, 2023

   

   mhdawson

   on Jun 30, 2023

   MemberAuthor

   More actions

   • Kevin mentioned branch protection in the last meeting.
3. KevinEady commented on Jul 5, 2023

   

   KevinEady

   on Jul 5, 2023

   Last edited by KevinEady

   Contributor

   More actions

   node-addon-api (scorecard)

   • Branch-Protection
     • Add branch protection on main (For GitHub, check out the steps here.)
     • Delete unused branches v2.x-staging, v1.x-staging
   • Code-Review
     • Make "code reviews" mandatory in your repository configuration. (Instructions for GitHub.)
     • Enforce the rule for administrators / code owners as well. (Instructions for GitHub.)
   • Add fuzzing...? (scorecard criteria, nodejs example)

   node-addon-examples (scorecard)

   • Add branch protection on main
   • Add LICENSE file
   • Make code reviews mandatory (as well as for administrators)
   • Make GitHub Actions CI workflow tokens read-only
   • Add CodeQL scanning similar to node-addon-api...?
   • Add fuzzing...?
4. mhdawson commented on Jul 12, 2023

   

   mhdawson

   on Jul 12, 2023

   MemberAuthor

   More actions

   Add branch protection for both node-addon-api and node-addon-examples.
5. mhdawson commented on Jul 12, 2023

   

   mhdawson

   on Jul 12, 2023

   MemberAuthor

   More actions

   PR to add boilerplate files to node-addon-examples - nodejs/node-addon-examples#213
6. mhdawson commented on Jul 12, 2023

   

   mhdawson

   on Jul 12, 2023

   MemberAuthor

   More actions

   @KevinEady can you expand a bit on Make GitHub Actions CI workflow tokens read-only
7. mhdawson commented on Jul 12, 2023

   

   mhdawson

   on Jul 12, 2023

   MemberAuthor

   More actions

   PR to add best practices to node-addon-api - nodejs/node-addon-examples#214
8. KevinEady commented on Jul 12, 2023

   

   KevinEady

   on Jul 12, 2023

   Contributor

   More actions

   Hi @mhdawson,

   ... can you expand a bit on Make GitHub Actions CI workflow tokens read-only

   From Assigning permissions to jobs - GitHub Docs:

   You can use permissions to modify the default permissions granted to the GITHUB_TOKEN, adding or removing access as required, so that you only allow the minimum required access.

   This is for the principle of least privilege, as discussed in the Token-Permissions Check documentation.

   This was mostly addressed by the SecurityBot PR nodejs/node-addon-examples#214 , eg: nodejs/node-addon-examples@a05f82c#diff-e98936aa52a6dd7416e4296e9628456227d834f7245967383fd9ff80fd985dadR9-R11 but it skipped a workflow that I added to the PR in this commit.

   So once this PR is merged, we can say that the Token-Permissions issue has been addressed and we will receive full points.
9. mhdawson commented on Jul 14, 2023

   

   mhdawson

   on Jul 14, 2023

   MemberAuthor

   More actions

   @KevinEady I think I merged the PR you mentioned, so we should be able to close this now?
10. mhdawson

    closed this as completedon Jul 28, 2023