Skip to content

Commit 17fc1a7

Browse files
lucacomelucacome
authored
Add OpenSSF Scorecard (#141)
1 parent c4cd100 commit 17fc1a7

File tree

2 files changed

+88
-11
lines changed

2 files changed

+88
-11
lines changed

‎.github/workflows/scorecard.yml

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: OpenSSF Scorecards
2+
on:
3+
branch_protection_rule:
4+
schedule:
5+
- cron: "42 15 * * 6" # run every Saturday at 15:42 UTC
6+
push:
7+
branches:
8+
- main
9+
10+
# Declare default permissions as read only.
11+
permissions: read-all
12+
13+
jobs:
14+
analysis:
15+
name: Scorecard analysis
16+
runs-on: ubuntu-latest
17+
permissions:
18+
# Needed to upload the results to code-scanning dashboard.
19+
security-events: write
20+
# Needed to publish results and get a badge (see publish_results below).
21+
id-token: write
22+
# Uncomment the permissions below if installing in a private repository.
23+
# contents: read
24+
# actions: read
25+
26+
steps:
27+
- name: "Checkout code"
28+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
29+
with:
30+
persist-credentials: false
31+
32+
- name: "Run analysis"
33+
uses: ossf/scorecard-action@08b4669551908b1024bb425080c797723083c031 # v2.2.0
34+
with:
35+
results_file: results.sarif
36+
results_format: sarif
37+
repo_token: ${{ secrets.SCORECARD_TOKEN }}
38+
39+
# Public repositories:
40+
# - Publish results to OpenSSF REST API for easy access by consumers
41+
# - Allows the repository to include the Scorecard badge.
42+
# - See https://github.com/ossf/scorecard-action#publishing-results.
43+
# For private repositories:
44+
# - `publish_results` will always be set to `false`, regardless
45+
# of the value entered here.
46+
publish_results: true
47+
48+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
49+
# format to the repository Actions tab.
50+
- name: "Upload artifact"
51+
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
52+
with:
53+
name: SARIF file
54+
path: results.sarif
55+
retention-days: 5
56+
57+
# Upload the results to GitHub's code scanning dashboard.
58+
- name: "Upload to code-scanning"
59+
uses: github/codeql-action/upload-sarif@0ba4244466797eb048eb91a6cd43d5c03ca8bd05 # v2.21.2
60+
with:
61+
sarif_file: results.sarif

‎README.md

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,27 @@
11

2-
[![Continuous Integration](https://github.com/nginxinc/nginx-plus-go-client/workflows/Continuous%20Integration/badge.svg)](https://github.com/nginxinc/nginx-plus-go-client/actions) [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) [![Go Report Card](https://goreportcard.com/badge/github.com/nginxinc/nginx-plus-go-client)](https://goreportcard.com/report/github.com/nginxinc/nginx-plus-go-client) [![FOSSA Status](https://app.fossa.com/api/projects/custom%2B5618%2Fgithub.com%2Fnginxinc%2Fnginx-plus-go-client.svg?type=shield)](https://app.fossa.com/projects/custom%2B5618%2Fgithub.com%2Fnginxinc%2Fnginx-plus-go-client?ref=badge_shield) [![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/nginxinc/nginx-plus-go-client?logo=github&sort=semver)](https://github.com/nginxinc/nginx-plus-go-client/releases/latest) ![GitHub go.mod Go version](https://img.shields.io/github/go-mod/go-version/nginxinc/nginx-plus-go-client?logo=go) [![Slack](https://img.shields.io/badge/slack-nginxcommunity-green?logo=slack)](https://nginxcommunity.slack.com)
2+
<!-- markdownlint-disable-next-line first-line-h1 -->
3+
[![OpenSSFScorecard](https://api.securityscorecards.dev/projects/github.com/nginxinc/nginx-plus-go-client/badge)](https://api.securityscorecards.dev/projects/github.com/nginxinc/nginx-plus-go-client)
4+
[![Continuous Integration](https://github.com/nginxinc/nginx-plus-go-client/workflows/Continuous%20Integration/badge.svg)](https://github.com/nginxinc/nginx-plus-go-client/actions)
5+
[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
6+
[![Go Report Card](https://goreportcard.com/badge/github.com/nginxinc/nginx-plus-go-client)](https://goreportcard.com/report/github.com/nginxinc/nginx-plus-go-client)
7+
[![FOSSA Status](https://app.fossa.com/api/projects/custom%2B5618%2Fgithub.com%2Fnginxinc%2Fnginx-plus-go-client.svg?type=shield)](https://app.fossa.com/projects/custom%2B5618%2Fgithub.com%2Fnginxinc%2Fnginx-plus-go-client?ref=badge_shield)
8+
[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/nginxinc/nginx-plus-go-client?logo=github&sort=semver)](https://github.com/nginxinc/nginx-plus-go-client/releases/latest)
9+
![GitHub go.mod Go version](https://img.shields.io/github/go-mod/go-version/nginxinc/nginx-plus-go-client?logo=go)
10+
[![Slack](https://img.shields.io/badge/slack-nginxcommunity-green?logo=slack)](https://nginxcommunity.slack.com)
311

412
# NGINX Plus Go Client
513

614
This project includes a client library for working with NGINX Plus API.
715

816
## About the Client
917

10-
`client/nginx.go` includes functions and data structures for working with NGINX Plus API as well as some helper functions.
18+
`client/nginx.go` includes functions and data structures for working with NGINX Plus API as well as some helper
19+
functions.
1120

1221
## Compatibility
1322

14-
This Client works against versions 4 to 8 of the NGINX Plus API. The table below shows the version of NGINX Plus where the API was first introduced.
23+
This Client works against versions 4 to 8 of the NGINX Plus API. The table below shows the version of NGINX Plus where
24+
the API was first introduced.
1525

1626
| API version | NGINX Plus version |
1727
|-------------|--------------------|
@@ -29,35 +39,41 @@ This Client works against versions 4 to 8 of the NGINX Plus API. The table below
2939
## Testing
3040

3141
### Unit tests
32-
```
33-
$ cd client
34-
$ go test
42+
43+
```console
44+
cd client
45+
go test
3546
```
3647

3748
### Integration tests
3849

3950
Prerequisites:
51+
4052
* Docker
4153
* golang
4254
* Make
4355
* NGINX Plus license - put `nginx-repo.crt` and `nginx-repo.key` into the `docker` folder.
4456

4557
Run Tests:
4658

47-
```
48-
$ make docker-build && make test
59+
```console
60+
make docker-build && make test
4961
```
5062

51-
This will build and run two NGINX Plus containers and create one docker network of type bridge, execute the client tests against both NGINX Plus APIs, and then clean up. If it fails and you want to clean up (i.e. stop the running containers and remove the docker network), please use `$ make clean`
63+
This will build and run two NGINX Plus containers and create one docker network of type bridge, execute the client tests
64+
against both NGINX Plus APIs, and then clean up. If it fails and you want to clean up (i.e. stop the running containers
65+
and remove the docker network), please use `make clean`
5266

5367
## Contacts
5468

55-
We’d like to hear your feedback! If you have any suggestions or experience issues with the NGINX Plus Go Client, please create an issue or send a pull request on GitHub.
56-
You can contact us directly via integrations@nginx.com or on the [NGINX Community Slack](https://nginxcommunity.slack.com).
69+
We’d like to hear your feedback! If you have any suggestions or experience issues with the NGINX Plus Go Client, please
70+
create an issue or send a pull request on GitHub. You can contact us directly via <integrations@nginx.com> or on the
71+
[NGINX Community Slack](https://nginxcommunity.slack.com).
5772

5873
## Contributing
5974

6075
If you'd like to contribute to the project, please read our [Contributing guide](CONTRIBUTING.md).
6176

6277
## Support
78+
6379
This project is not covered by the NGINX Plus support contract.

0 commit comments

Comments
 (0)