chore: add security-insights, dependabot, and scorecard - #2335
Open
pankajbaid567 wants to merge 1 commit into
Open
chore: add security-insights, dependabot, and scorecard#2335pankajbaid567 wants to merge 1 commit into
pankajbaid567 wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds supply-chain/security reporting configuration to the flatcar/Flatcar repository to improve CNCF CLOMonitor results by introducing Security Insights metadata, Dependabot updates for GitHub Actions, and OpenSSF Scorecard scanning (plus a README badge).
Changes:
- Add a
SECURITY-INSIGHTS.ymlmanifest intended to satisfy CLOMonitor’ssecurity_insightsanddependencies_policychecks. - Add
.github/dependabot.ymlto enable Dependabot for GitHub Actions. - Add an OpenSSF Scorecard workflow and a Scorecard badge to the README.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
SECURITY-INSIGHTS.yml |
Adds a Security Insights manifest intended for CLOMonitor/security metadata consumption. |
.github/dependabot.yml |
Enables Dependabot updates for github-actions. |
.github/workflows/scorecard-analysis.yml |
Adds scheduled OpenSSF Scorecard analysis with SARIF upload. |
README.md |
Adds the OpenSSF Scorecard badge/link. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+1
to
+14
| header: | ||
| schema-version: 2.2.0 | ||
| expiration-date: 2027-01-01 | ||
| project-lifecycle: | ||
| status: active | ||
| security-contacts: | ||
| - type: email | ||
| value: security@flatcar-linux.org | ||
| vulnerability-reporting: | ||
| accepts-vulnerability-reports: true | ||
| email-contact: security@flatcar-linux.org | ||
| dependencies: | ||
| env-dependencies-policy: | ||
| policy-url: https://github.com/flatcar/Flatcar/blob/main/adding-new-packages.md |
Comment on lines
+7
to
+9
| schedule: | ||
| # Daily | ||
| - cron: '30 1 * * *' |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
chore: Add Security Insights, Dependabot, and Scorecard to improve CLOMonitor score
This PR implements several security reporting and supply-chain tooling configuration changes to improve the CNCF CLOMonitor score for the Flatcar project as requested in #2317. Previously, CLOMonitor only monitored
flatcar/Flatcarandflatcar-websiteleading to low scores primarily because there are no actual software releases in the docs repository.To resolve the failing checks for
security_insights,dependencies_policy,dependency_update_tool, andopenssf_scorecard_badge, this PR introduces a.github/dependabot.ymlconfiguration (which checks for GitHub Actions updates), aSECURITY-INSIGHTS.ymladhering to spec v2.2.0, an OpenSSF Scorecard workflow imported fromflatcar/nebraska, and the corresponding Scorecard badge in theREADME.md.With these configurations in place, the
flatcar/Flatcarrepository will reflect appropriate CNCF best practices, acting as the foundation for registering Flatcar's code repositories (flatcar/scripts, etc.) for security scrutiny by CLOMonitor in follow-up PRs.How to use
Reviewers can validate this PR by checking:
SECURITY-INSIGHTS.ymlcorrectly targets spec2.2.0and references theadding-new-packages.mdas the dependencies policy.github-actions.Testing done
Validated the GitHub Actions
scorecard-analysis.ymlworkflow syntax.Verified that the
SECURITY-INSIGHTS.ymlconforms to the2.2.0spec schema rules forenv-dependencies-policy.Visualized the Scorecard README badge locally to ensure the link properly directs to
securityscorecards.dev.Changelog entries added in the respective
changelog/directory (user-facing change, bug fix, security fix, update)Inspected CI output for image differences:
/bootand/usrsize, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.