ossf/scorecard
1
1
Fork 0
mirror of https://github.com/ossf/scorecard.git synced 2024-09-11 08:55:27 +03:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Add security policy to e2e test.

Browse Source
This commit is contained in:
Abhishek Arya 2021-02-14 09:43:21 -08:00 committed by Naveen
parent af2132e927
commit fc251d9d42
4 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Makefile
View File

@ -23,22 +23,22 @@ golangci-lint:
lint: golangci-lint ## Run golangci-lint linter
$(GOLANGCI_LINT) run
check-env:
ifndef GITHUB_AUTH_TOKEN
$(error GITHUB_AUTH_TOKEN is undefined)
endif
.PHONY: e2e
# export GITHUB_AUTH_TOKEN with personal access token to run the e2e
e2e: build check-env
ginkgo --skip="E2E TEST:executable" -p -v -cover ./...
# export GITHUB_AUTH_TOKEN with personal access token to run the e2e
e2e: build check-env
ginkgo --skip="E2E TEST:executable" -p -v -cover ./...
.PHONY: ci-e2e
# export GITHUB_AUTH_TOKEN with personal access token to run the e2e
# export GITHUB_AUTH_TOKEN with personal access token to run the e2e
ci-e2e: build check-env
$(call ndef, GITHUB_AUTH_TOKEN)
mkdir -p bin
./scorecard --repo=https://github.com/ossf/scorecard --format json > ./bin/results.json
ginkgo -p -v -cover ./...
ginkgo -p -v -cover ./...

2
README.md
View File

@ -193,7 +193,7 @@ The following checks are all run against the target project:
| Name | Description |
| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Security-MD | Does the project contain a [security policy](https://docs.github.com/en/free-pro-team@latest/github/managing-security-vulnerabilities/adding-a-security-policy-to-your-repository)? |
| Security-Policy | Does the project contain a [security policy](https://docs.github.com/en/free-pro-team@latest/github/managing-security-vulnerabilities/adding-a-security-policy-to-your-repository)? |
| Contributors | Does the project have contributors from at least two different organizations? |
| Frozen-Deps | Does the project declare and freeze [dependencies](https://docs.github.com/en/free-pro-team@latest/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)? |
| Signed-Releases | Does the project cryptographically [sign releases](https://wiki.debian.org/Creating%20signed%20GitHub%20releases)? |

2
checks.md
View File

@ -8,7 +8,7 @@ They are all subject to change, and have room for improvement!
If you have ideas for things to add, or new ways to detect things,
please contribute!
## Security-MD
## Security-Policy
This check tries to determine if a project has published a security policy.
It works by looking for a file named `SECURITY.md` (case-insensitive) in a

2
e2e/executable_test.go
View File

@ -55,6 +55,8 @@ var _ = Describe("E2E TEST:executable", func() {
Expect(c.Pass).Should(BeTrue(), c.CheckName)
case "SAST":
Expect(c.Pass).Should(BeTrue(), c.CheckName)
case "Security-Policy":
Expect(c.Pass).Should(BeTrue(), c.CheckName)
case "Signed-Releases":
Expect(c.Pass).Should(BeFalse(), c.CheckName)
case "Signed-Tags":