Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 23:30 UTC
ci: add dep review, OSSF scorecard actions (#7063)
* ci: add dep review action Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * sprinkle permissions on Actions jobs Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * README: add OpenSSF best practices badge Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * add draft OpenSSF Scorecard workflow Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
Mohammed Al Sahaf committed
Jun 13, 2025 at 02:40 UTC
7a33f481f19439a73b7d15aacca789e54a9cdca1
6 files changed
+112
-2
.github/workflows/ci.yml
+10
-1
@@ -55,7 +55,10 @@ jobs:
55
SUCCESS: 'True'
56
57
runs-on: ${{ matrix.OS_LABEL }}
58
-
58
+ permissions:
59
+ contents: read
60
+ pull-requests: read
61
+ actions: write # to allow uploading artifacts and cache
62
steps:
63
- name: Checkout code
64
uses: actions/checkout@v4
@@ -142,6 +145,9 @@ jobs:
145
146
s390x-test:
147
name: test (s390x on IBM Z)
148
+ permissions:
149
+ contents: read
150
+ pull-requests: read
151
runs-on: ubuntu-latest
152
if: github.event.pull_request.head.repo.full_name == 'caddyserver/caddy' && github.actor != 'dependabot[bot]'
153
continue-on-error: true # August 2020: s390x VM is down due to weather and power issues
@@ -194,6 +200,9 @@ jobs:
200
201
goreleaser-check:
202
runs-on: ubuntu-latest
203
+ permissions:
204
+ contents: read
205
+ pull-requests: read
206
if: github.event.pull_request.head.repo.full_name == 'caddyserver/caddy' && github.actor != 'dependabot[bot]'
207
steps:
208
- name: Checkout code
.github/workflows/cross-build.yml
+3
@@ -40,6 +40,9 @@ jobs:
40
GO_SEMVER: '~1.24.1'
41
42
runs-on: ubuntu-latest
43
+ permissions:
44
+ contents: read
45
+ pull-requests: read
46
continue-on-error: true
47
steps:
48
- name: Checkout code
.github/workflows/lint.yml
+16
@@ -62,6 +62,9 @@ jobs:
62
# only-new-issues: true
63
64
govulncheck:
65
+ permissions:
66
+ contents: read
67
+ pull-requests: read
68
runs-on: ubuntu-latest
69
steps:
70
- name: govulncheck
@@ -69,3 +72,16 @@ jobs:
72
with:
73
go-version-input: '~1.24.1'
74
check-latest: true
75
+
76
+ dependency-review:
77
+ runs-on: ubuntu-latest
78
+ permissions:
79
+ contents: read
80
+ pull-requests: write
81
+ steps:
82
+ - name: 'Checkout Repository'
83
+ uses: actions/checkout@v4
84
+ - name: 'Dependency Review'
85
+ uses: actions/dependency-review-action@v4
86
+ with:
87
+ comment-summary-in-pr: on-failure
.github/workflows/release_published.yml
+4
-1
@@ -13,7 +13,10 @@ jobs:
13
os:
14
- ubuntu-latest
15
runs-on: ${{ matrix.os }}
16
-
16
+ permissions:
17
+ contents: read
18
+ pull-requests: read
19
+ actions: write
20
steps:
21
22
# See https://github.com/peter-evans/repository-dispatch
.github/workflows/scorecard.yml
new
+78
@@ -0,0 +1,78 @@
1
+# This workflow uses actions that are not certified by GitHub. They are provided
2
+# by a third-party and are governed by separate terms of service, privacy
3
+# policy, and support documentation.
4
+
5
+name: OpenSSF Scorecard supply-chain security
6
+on:
7
+ # For Branch-Protection check. Only the default branch is supported. See
8
+ # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
9
+ branch_protection_rule:
10
+ # To guarantee Maintained check is occasionally updated. See
11
+ # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
12
+ schedule:
13
+ - cron: '20 2 * * 5'
14
+ push:
15
+ branches: [ "master" ]
16
+
17
+# Declare default permissions as read only.
18
+permissions: read-all
19
+
20
+jobs:
21
+ analysis:
22
+ name: Scorecard analysis
23
+ runs-on: ubuntu-latest
24
+ # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
25
+ if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
26
+ permissions:
27
+ # Needed to upload the results to code-scanning dashboard.
28
+ security-events: write
29
+ # Needed to publish results and get a badge (see publish_results below).
30
+ id-token: write
31
+ # Uncomment the permissions below if installing in a private repository.
32
+ # contents: read
33
+ # actions: read
34
+
35
+ steps:
36
+ - name: "Checkout code"
37
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
38
+ with:
39
+ persist-credentials: false
40
+
41
+ - name: "Run analysis"
42
+ uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
43
+ with:
44
+ results_file: results.sarif
45
+ results_format: sarif
46
+ # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
47
+ # - you want to enable the Branch-Protection check on a *public* repository, or
48
+ # - you are installing Scorecard on a *private* repository
49
+ # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
50
+ # repo_token: ${{ secrets.SCORECARD_TOKEN }}
51
+
52
+ # Public repositories:
53
+ # - Publish results to OpenSSF REST API for easy access by consumers
54
+ # - Allows the repository to include the Scorecard badge.
55
+ # - See https://github.com/ossf/scorecard-action#publishing-results.
56
+ # For private repositories:
57
+ # - `publish_results` will always be set to `false`, regardless
58
+ # of the value entered here.
59
+ publish_results: true
60
+
61
+ # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
62
+ # file_mode: git
63
+
64
+ # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
65
+ # format to the repository Actions tab.
66
+ - name: "Upload artifact"
67
+ uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
68
+ with:
69
+ name: SARIF file
70
+ path: results.sarif
71
+ retention-days: 5
72
+
73
+ # Upload the results to GitHub's code scanning dashboard (optional).
74
+ # Commenting out will disable upload of results to your repo's Code Scanning dashboard
75
+ - name: "Upload to code-scanning"
76
+ uses: github/codeql-action/upload-sarif@v3
77
+ with:
78
+ sarif_file: results.sarif
README.md
+1
@@ -14,6 +14,7 @@
14
<p align="center">Caddy is an extensible server platform that uses TLS by default.</p>
15
<p align="center">
16
<a href="https://github.com/caddyserver/caddy/actions/workflows/ci.yml"><img src="https://github.com/caddyserver/caddy/actions/workflows/ci.yml/badge.svg"></a>
17
+ <a href="https://www.bestpractices.dev/projects/7141"><img src="https://www.bestpractices.dev/projects/7141/badge"></a>
18
<a href="https://pkg.go.dev/github.com/caddyserver/caddy/v2"><img src="https://img.shields.io/badge/godoc-reference-%23007d9c.svg"></a>
19
<br>
20
<a href="https://x.com/caddyserver" title="@caddyserver on Twitter"><img src="https://img.shields.io/twitter/follow/caddyserver" alt="@caddyserver on Twitter"></a>