SOSS Community Day Japan 2024

OpenSSF Scorecard and Allstar are tools for automatically scanning source code repositories for security misconfigurations. Scorecard looks at a GitHub or GitLab project’s source code, CI workflows, and repository settings and provides an actionable list of findings for a maintainer to improve their project’s security practices. Allstar is a way to run security analysis at scale, and automatically remediate issues. This talk will focus on one specific use case that blue teams face: how can Scorecard be used to secure first party repos? Is there a way to integrate Scorecard into an actual development process so that it doesn’t just detect an issue, but prevents it from being introduced into the supply chain? There are two aspects to this answer: infrastructure and policy. We’ll look at how probes enable the creation of granular policies, data pipelines for gathering results from probe runs, and techniques for shifting Scorecard scans left with pre-commit GitHub Actions.