Addressing Security Concerns Raised by OpenSSF Scorecard#20090
Addressing Security Concerns Raised by OpenSSF Scorecard#20090freben merged 6 commits intobackstage:masterfrom
Conversation
|
Uffizzi Preview |
|
cc/ @adamdmharvey @Rugvip |
|
Nice one! As you can probably see, numerous E2E failures for the pipeline. I'm not familiar with the exact steps that the harden runner performs, but perhaps it's removing something the tests depend on? I wonder if you want to try maybe removing the harden step (like commenting it out) for the E2E action maybe causes it to run clean? if so then you can at least identify the root cause of the failure to focus more on what it does. (and then potentially split the PR into one that just does the version pin/permissions and another for harden? not sure!) |
|
Cheers for the inputs @adamdmharvey - was stuck in travelling hell past few days! I'll rebase with master and let's see how it looks. Post that will comment out harden runners changes. |
|
Wow! @adamdmharvey As soon as I tried commenting out the Harden runners, the docker registries are seemingly facing downtime!? 😭 Logs:
This is def not due to restricted permissions else we would have got 401/403 but getting 5xx I'll recheck in a while! |
|
Triggered a re-run of the failed actions; definitely passed the Docker step... |
Cheers, 5xx must have been resolved - I'll re-trigger all pipelines and take it from there. |
|
@adamdmharvey Both E2E Testing failing due to this application level issue. This is outside scope of this PR as I've only updated the workflow files. Any nudges on how to proceed? |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Signed-off-by: NishkarshRaj <nishkarshraj000@gmail.com>
…kflows Signed-off-by: NishkarshRaj <nishkarshraj000@gmail.com>
5bbf1c7 to
b4d24e9
Compare
|
took the liberty of rebasing to see if builds are happier |
Thanks @freben - only 2 failures remain but I can't make sense of these logs. Can you nudge what shall I change to proceed? |
|
We still have some remaining windows build issues, don't worry about those. Why is the harden runner commented out everywhere? |
Was just checking if the failed pipelines are caused by Harden Runner - not really so I will be uncommenting them now. Will commit and leave it to you guys for best next steps :) |
|
Looks like something has gone awry here with the rebase, could you rebase again to just have your commits in here @NishkarshRaj? 🙏 |
Oh snap! I am on it :) |
Signed-off-by: NishkarshRaj <nishkarshraj000@gmail.com>
1e3f14b to
595ed3b
Compare
|
@freben @benjdlambert : Fixed the rebase mistake, hope this works now. |
|
we've put a "merge after release" label on this so we can revisit merging it after the mainline release out of an abundance of caution against getting into release problems. |
Hey, I just made a Pull Request!
Added:
Note: This PR is modified version of #19249
✔️ Checklist
Signed-off-byline in the message. (more info)