{"id":62472,"date":"2022-01-19T07:00:02","date_gmt":"2022-01-19T15:00:02","guid":{"rendered":"https:\/\/github.blog\/?p=62472"},"modified":"2022-01-24T17:29:21","modified_gmt":"2022-01-25T01:29:21","slug":"reducing-security-risk-oss-actions-opensff-scorecards-v4","status":"publish","type":"post","link":"https:\/\/github.blog\/open-source\/reducing-security-risk-oss-actions-opensff-scorecards-v4\/","title":{"rendered":"Reducing security risk in open source software with GitHub Actions and OpenSSF Scorecards V4"},"content":{"rendered":"

GitHub is committed to helping secure the future of open source security, and it is why we continue to partner with our industry peers through the Open Source Security Foundation (OpenSSF)<\/a>. Today we\u2019re excited to announce the V4 release of the OpenSSF\u2019s Scorecard<\/a> project in partnership with Google<\/a>.<\/p>\n

Scorecards<\/a> is an automated security tool that flags risky supply chain practices in open source projects. We have added a GitHub Action<\/a> and starter workflow<\/a> into the GitHub user interface and Marketplace to help developers follow best security practices. Once configured, the Scorecards Action runs automatically on repository changes, and alerts developers about risky supply chain practices using the built-in code scanning experience. The Scorecards project makes a number of checks<\/a>, including whether the project has a static analysis tool, like CodeQL, configured.<\/p>\n

The results are automatically sent to the GitHub code scanning alerts API and appear under the security tab for the project. This will help open source software projects to understand whether they are implementing the Scorecards project\u2019s best practices, and help assure their users about the precautions they’re taking on security.<\/p>\n

To give it a try, head over to GitHub and create a personal access token<\/a>, if you don\u2019t already have one. Then, navigate to your project, click on the Security<\/strong> tab, and Set up code scanning<\/strong>.<\/p>\n

<\/p>\n

Then select the OSSF Scorecards option, and click Set up this workflow<\/strong>.<\/p>\n

\nThe workflow is preconfigured to run on every contribution and will upload results to the code scanning API for remediation. You will need to copy your PAT into the workflow. Check the comments for the appropriate location.<\/p>\n

Note: If you already have code scanning configured on your project, you may see a different UI experience within the code scanning alerts page. Simply click Add more scanning tools<\/strong> as shown below.<\/p>\n

<\/p>\n

And just like that, results will start flowing into your Security tab for review.<\/p>\n

<\/p>\n

While you\u2019re setting up Scorecards, you can also configure CodeQL or one of our other integrated third-party static analysis tools, which is a great first step toward securing your project.<\/p>\n

CodeQL, the code scanning API, and 1,000 Actions minutes are included for free to public repositories on GitHub.com.<\/p>\n

These features are also available to enterprises through GitHub Enterprise and GitHub Advanced Security. To learn more about GitHub\u2019s Platform and Application Security, please see https:\/\/github.com\/features\/security<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

We\u2019re excited to announce the V4 release of the OpenSSF\u2019s Scorecard project in partnership with Google.<\/p>\n","protected":false},"author":1811,"featured_media":62479,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_gh_post_show_toc":"no","_gh_post_is_no_robots":"","_gh_post_is_featured":"no","_gh_post_is_excluded":"","_gh_post_is_unlisted":"","_gh_post_related_link_1":"","_gh_post_related_link_2":"","_gh_post_related_link_3":"","_gh_post_sq_img":"https:\/\/github.blog\/wp-content\/uploads\/2022\/01\/GitHub-Open-Source_teal-square-icon.png","_gh_post_sq_img_id":"62574","_gh_post_cta_title":"","_gh_post_cta_text":"","_gh_post_cta_link":"","_gh_post_cta_button":"Click Here to Learn More","_gh_post_recirc_hide":"","_gh_post_recirc_col_1":"","_gh_post_recirc_col_2":"","_gh_post_recirc_col_3":"","_gh_post_recirc_col_4":"","_featured_video":"","_gh_post_additional_query_params":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"_wpas_customize_per_network":false,"_links_to":"","_links_to_target":""},"categories":[67],"tags":[122,1709],"coauthors":[2357],"class_list":["post-62472","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-open-source","tag-github-actions","tag-supply-chain-security"],"yoast_head":"\n