ci: add plumber workflow security check - #3505
Open
Totara-thib wants to merge 1 commit into
Open
Conversation
Runs the Plumber CLI on pushes to master and on pull requests. It statically checks the workflows under .github/workflows for supply chain risks (unpinned actions, missing token permission scopes, unverified remote scripts) and uploads a SARIF report so findings show up in the Security tab. The gate passes at 85 of 100 points, so one small finding does not block PRs. The .plumber.yaml overlay inherits the tool's built-in baseline and only records what differs for this repo: rust-toolchain is trusted on top of the curated default source list, and the mutable-remote-code control is off with a comment because its only finding is rustup's own install script. The README badge works like OpenSSF Scorecard's published results and shows the current score of master.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Companion to #3504, merge that one first: the check added here flags the unpinned actions until the hardening lands, then it goes green.
This adds Plumber to CI, the tool I used to find the unpinned refs. It scans the workflows on each push to master and on each PR, and fails when something regresses: an unpinned action, a job without a permissions block, an unverified remote script, that kind of thing. The gate passes at 85 of 100 points, so one small finding does not block PRs.
plumber.yml: pinned by sha, minimal permissions, findings go to the Security tab as SARIF (skipped on PRs from forks, the report stays as a workflow artifact there)..plumber.yaml: a small overlay that inherits the tool's built-in baseline; only what differs for this repo is written. rust-toolchain is trusted on top of the curated default source list, and one control is off with a comment because its only finding is rustup's own install script, which is how every Rust CI bootstraps. Everything else, including new controls in future releases, follows the defaults automatically.README.md: one line, the score badge next to the existing ones.Score badge
I enabled
score-pushon the action. It works like OpenSSF Scorecard's published results: every run, on any branch, publishes the score to score.getplumber.io, and that feeds the badge in the README. Scores are public and the badge always shows the state of master. A failed publish never fails your CI. Until the first run the badge reads UNKNOWN in gray, then it flips to the grade. If you would rather not have it, drop the README line and thescore-pushinput, the rest works the same.With the hardening in, this runs green with a score of A. Set
soft-fail: trueif you prefer report only, without gating PRs.To be fully transparent: I work on Plumber. If you do not want the tool in your CI, no hard feelings, say so and I close this PR, the hardening PR stands on its own.