Commit Graph

93 Commits

Author SHA1 Message Date
laurentsimon
b8d7a6b722
make critical (#1348) 2021-12-03 17:55:54 +00:00
dota17
6a7e314c37 1.Add the check Dangerous-Workflow
2.Fix the typo of rubygems
2021-12-01 07:44:28 -06:00
Evgeny Vereshchagin
6a2fb2edc2
Add LGTM to the SAST check (#1232)
According to https://github.com/apps/lgtm-com
"LGTM is a code analysis platform for identifying vulnerabilities early and preventing
them from reaching production". It's used by `systemd`, `lxc` and a lot of other large
open source projects. The check is
still kind of broken in the sense that it fails to detect
projects where every PR is analyzed by LGTM before getting merged
but it's better than nothing I guess.

Co-authored-by: Naveen <172697+naveensrinivasan@users.noreply.github.com>
2021-11-10 10:09:11 -08:00
Chris McGehee
4fbd0fe93e Adding Chris as facilitator 2021-11-08 18:11:07 -06:00
Naveen
ddd770ae14
📖 Updated the community links (#1216)
* :docs: Updated the community links 

Updated the community links to be more accessible. Took the idea from https://github.com/tektoncd/community/blob/main/working-groups.md#chains

* Update README.md
2021-11-04 16:59:43 +00:00
Naveen
1cc8601c2c
📖 Included the meeting minutes (#1202)
* 📖 Included the meeting minutes

Included the meeting minutes in the README.

* Update README.md
2021-11-01 00:58:22 +00:00
olivekl
6f1a1cb1f4
📖 Update README.md (#1160)
* Update README.md

Add Prominent Scorecards Users section
Add email groups
Fix calendar link

* Update README.md

Add https:// to links in "Prominent Users" section

Co-authored-by: Naveen <172697+naveensrinivasan@users.noreply.github.com>
2021-10-25 22:06:53 +00:00
Romain Dauby
c26bea648d
📖 Minor fixes to markdown links (#1141)
* Minor fixes to markdown links

* Minor fix generate docs
2021-10-19 12:14:11 -07:00
olivekl
da94c7c253
📖 Update Install command for version 3 (#1125)
* Update Install command for version 3

Change v2@latest to v@latest in README.md

* Update install instruction to use GitHub releases 

Remove `go install` instructions and replace with instructions to download binary from GitHub releases

* Update install instructions for GOPATH caps

Change gopath to GOPATH
2021-10-15 12:10:36 -07:00
laurentsimon
8c2e123155
Update BQ table in readme (#1116)
* v2 table

* comments
2021-10-07 16:26:00 +00:00
olivekl
c45f70bc90
📖 Add aggregate scoring documentation (#1063)
* Update README.md

Add scoring explanation, including aggregate scoring and risk weighting
Add Aggregate score to example output
Add omitted word

* Update README.md

Minor edit, remove word

Co-authored-by: Azeem Shaikh <azeemshaikh38@gmail.com>
2021-09-30 17:47:35 +00:00
Azeem Shaikh
06c14a64ba
Minor fixes to README.md (#1066) 2021-09-27 19:18:56 +00:00
olivekl
44dd10d465
📖 Olivekl patch 1 (#1039)
* Update README.md

Add new Contents section at top that includes links to to other documentation pages. 
Remove old Contents section that linked only to the page below.

* Update README.md

Change “Supportability” to “Prerequisites” and add GoLang requirement. 
Rename “Troubleshooting” to “Report Problems” and remove Slack reference
Rename “Contributing” to “Get Involved” and add Slack reference. 
Tweak headings for clarity/concision.

* Update README.md

Fix link (Get Involved)

* Update README.md

Moved content on page to match new Table of Contents format
Added subheadings linking out to other pages to match new Table of Contents format
Renamed "Motivation" to "What is Scorecards?"

* Update README.md

Removed out-of-date info on Pass/Fail scoring from Usage section
Added info about previous Pass/Fail scoring to Public Data section
Removed out-of-date Pass/Fail example from Package Manager section

* Update README.md

Changed links from absolute to relative paths
Moved "Overview" section to top

* Update README.md

Renamed "Learn More About Each Check" section to "Detailed Check Documentation"

* Update README.md

Added example for format flag
Trimmed example for package manager (since removing the out-of-date results example)

* Update README.md

Moved "Basic Usage" heading
Minor tweaks for clarity

* Update README.md

Change "Get Involved" heading to "Connect with the Scorecards Community"

* Update README.md

Replace colon with comma for consistency

* Update README.md

Fix line formatting
Fix explanation of BigQuery pass/fail scoring
Update install command

Co-authored-by: Azeem Shaikh <azeemshaikh38@gmail.com>
2021-09-22 14:05:37 +00:00
David A. Wheeler
a5a6a30cec
README.md: Add hyperlinks to docs/checks.md (#1008)
This modifies README.md to add hyperlinks
directly to each of the details in `docs/checks.md`.
That way, people who want to know more about a specific check
can jump immediately to that information.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
2021-09-13 18:38:16 +00:00
olivekl
924d4d5da9
📖 Update README.md (#976)
* Update README.md

Minor fixes for clarity.

* Update README.md

* Update README.md

Reinstating "Understanding Scorecard Results" paragraph after accidental deletion.

* Update README.md

Delete test phrase ("DELETE THIS")

Co-authored-by: Azeem Shaikh <azeemshaikh38@gmail.com>
2021-09-08 08:22:25 -07:00
nathan-415
062075823c
Updated go get to go install (#953)
Based on recommendations from the `go` tool.
```
go get: installing executables with 'go get' in module mode is deprecated.
	Use 'go install pkg@version' instead.
	For more information, see https://golang.org/doc/go-get-install-deprecation
	or run 'go help get' or 'go help install'.
```

Co-authored-by: Naveen <172697+naveensrinivasan@users.noreply.github.com>
2021-09-03 15:09:32 +00:00
olivekl
c9a617b236
📖 Expand "Motivation" section (#924)
* Expand "Motivation" section

Add description of the tool; introduce "checks" as a term used throughout documentation

* Update README.md
2021-08-26 20:53:40 +00:00
laurentsimon
9eb7929ebc
🐛 Address friction logs' comments (#899)
* fixes

* fix

* fix

* fixes

* doc

* missing file

* fixes

* comments

* typo
2021-08-25 21:02:23 +00:00
Meder Kydyraliev
27c5821764
Update README.md (#888) 2021-08-24 00:12:03 +00:00
Azeem Shaikh
1c9a255642
Update docs to use :stable release (#865)
Co-authored-by: Azeem Shaikh <azeems@google.com>
Co-authored-by: Naveen <172697+naveensrinivasan@users.noreply.github.com>
2021-08-18 15:41:20 +00:00
Azeem Shaikh
d4701c4a4e
Delete Signed-Tags check from Scorecard (#851)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2021-08-12 22:26:50 +00:00
Azeem Shaikh
ce7d4c396d
Update BQ query in README.md (#831)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2021-08-10 17:56:39 -07:00
laurentsimon
9b2f3f5270
broken link to doc (#799)
* broken link

* main doc link
2021-08-02 14:33:17 -07:00
Azeem Shaikh
1e6d99eb20
Remove PullRequest check (#771)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2021-07-29 20:58:36 +00:00
Appu
782edb7c18
Update local install instructions to use v2 (#763)
Signed-off-by: Appu Goundan <appu@google.com>

Co-authored-by: Abhishek Arya <inferno@chromium.org>
2021-07-27 16:48:47 +00:00
laurentsimon
45ea97e502
Add more github token names for env variable (#694)
* draft

* commit 1

* dead code

* comments

* merge fix

* typo
2021-07-19 18:56:42 +00:00
Naveen
f4f1e110c7
📖 Included docker documentation in README (#681)
* Included docker run for easier consumption of scorecard.
2021-07-16 17:18:42 +00:00
laurentsimon
dd1a412b85
Update readme (#634)
* update readme

* comments
2021-06-29 19:02:12 +00:00
Naveen
ec7755da82 Removed Code Coverage 2021-06-29 13:45:22 -05:00
Oliver Chang
34621504fb
Add a Vulnerabilities check. (#628)
Uses OSV to check this.

Fixes #52.
2021-06-29 03:09:40 +00:00
Azeem Shaikh
96ea5577d1
Update documentation (#583)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2021-06-16 21:05:46 -07:00
Naveen
ecc072c3b7
📖 Updated README with community content (#547)
Included slack channel
Included bi-weekly meeting link
2021-06-04 21:47:45 +00:00
Chas. J. Owens IV
1ec9ada137
correct the path to a file (#543)
correct path to the file that lists the projects checked each night

Co-authored-by: Naveen <172697+naveensrinivasan@users.noreply.github.com>
2021-06-04 15:08:30 +00:00
Naveen
14dfc45fae
🌱 Move the docker containers to gcr.io (#419)
* Included a build on push to master on gcr.io
  * Updated the README with the gcr.io
  * Removed the docker.yaml build push
2021-05-11 14:11:06 +00:00
Naveen
a440bf6294
🌱 Removed the dockerbuild experimental features (#409)
* Removed the docker build experimental feature so that cloudbuild can
build.
2021-05-07 07:49:30 -05:00
Oliver Chang
df27afd3b3
Make checks documentation machine readable. (#345)
*  Make checks documentation machine readable.

Make checks.yaml as a machine and human readable source of truth of
checks documentation.

A tiny Python script is also added to generate checks.json and checks.md
from this file.

* move checks scripts and files
2021-04-16 11:15:56 -07:00
naveen
27ec7fff8d Docs - Updated the docs for cron
Included a section within the CONTRIBUTING.md about the dailyscore and
cron job.
2021-03-15 12:38:58 -04:00
naveen
3d6b080241 Doc - Included gitcache documentation
Included documentation for gitcache.
2021-03-12 19:24:29 -05:00
Abhishek Arya
a44dd6a758
Add pypi and ruby gems package support. (#226)
Adds some more package managers to
https://github.com/ossf/scorecard/issues/33

Co-authored-by: Naveen <172697+naveensrinivasan@users.noreply.github.com>
2021-03-01 11:21:20 -05:00
naveen
cab29a2747 Feat- Use cloud buckets for caching
Use cloud buckets for httpcache.

The implementation uses https://github.com/google/go-cloud for it to be
cloud vendor agnostic.
2021-02-24 11:17:50 -05:00
naveen
586e3d60be Doc - Update README with the TOC
Updated the README with TOC and included instructions for docker usage.
2021-02-23 10:47:44 -05:00
Naveen
db81680172
Feat-Implement httpcache middleware for GitHub API (#203)
The GitHub API supports conditional requests
https://docs.github.com/en/rest/overview/resources-in-the-rest-api#conditional-requests

https://github.com/google/go-github supports Conditional requests
https://github.com/google/go-github#conditional-requests

As we are scaling more and more projects this would add a lot of value.

Initial run fetches information using `httpcache` as a middleware,
which caches the HTTP response initially in a large disk (PVC),
probably move to Redis later as a cache instead of disk.

Subsequent `cron runs` will utilize the `httpcache` for checking content modification and
load it from the cache if it isn't modified, which reduces the hitting the
Rate Limit of the GitHub API.
2021-02-22 17:18:28 +00:00
naveen
9c4a4596ed Testing - Slash command 2021-02-19 14:04:24 -05:00
naveen
f57080098c Doc - Updates to README and CONTRIBUTING 2021-02-16 17:00:36 -05:00
Abhishek Arya
fc251d9d42 Add security policy to e2e test. 2021-02-14 12:50:24 -05:00
Naveen
ca1d6e85f0
Doc - Update README with the docker image (#163) 2021-02-11 15:27:16 -08:00
naveen
f385b0d9df Feature - run scans from npm pacakge name
Implemented scans from npm package name.
2021-02-02 16:07:41 -05:00
Abhishek Arya
8493b0b9a0 Add remediation steps for various checks. 2021-01-27 08:19:49 -05:00
naveen
2a1463b315 Feature - Report codecoverage to codecov.io 2021-01-26 17:49:11 -05:00
Abhishek Arya
dc8d1fecb9 Add packaging check. 2021-01-15 13:44:52 -05:00