Skip to content

📖 Update README about the restrictions for scorecard-action:v2 #779

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 27, 2022
Merged

📖 Update README about the restrictions for scorecard-action:v2 #779

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,15 @@ The Scorecards GitHub Action is free for all public repositories. Private reposi

## Breaking changes in v2

Starting from scorecard-action:v2, `GITHUB_TOKEN` permissions needs to incude
`token_id: write` for `publish_results: true`. This is needed to access GitHub's
OIDC token whuch verifies the authenticity of the result when publishing it.

Starting from scorecard-action:v2, `GITHUB_TOKEN` permissions or job permissions needs to incude
`id-token: write` for `publish_results: true`. This is needed to access GitHub's
OIDC token which verifies the authenticity of the result when publishing it.

scorecard-action:v2 also requires that the steps in the job running ossf/scorecard-action step
only belong to an approved list of GitHub actions - "actions/checkout", "actions/upload-artifact", "github/codeql-action/upload-sarif".
We understand that this is restrictive but currently this is needed given that GitHub workflow steps belonging to a job
run in the same environment. To ensure the integrity of the results we publish, we are currently making this restriction a requirement
while we work on making this feature more flexible without needing these restrictions.
________
[Installation](#installation)
- [Authentication](#authentication-with-pat)
Expand Down