openssf: Move openssf-scorecard.yml into .github/workflows

[henrywang]

Workflow link does not work, use file instead
See: https://github.com/bootc-dev/infra/actions/runs/19864862091

[gemini-code-assist]

Summary of Changes

Hello @henrywang, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request resolves an issue where the OpenSSF Scorecard analysis workflow was not executing due to an incorrect file path. By relocating the openssf-scorecard.yml configuration file to the conventional .github/workflows directory, the PR ensures the continuous security analysis of the repository functions as expected, improving the reliability of our automated checks.

Highlights

• Workflow Relocation: The OpenSSF Scorecard analysis workflow configuration file has been moved from common/.github/workflows/openssf-scorecard.yml to the standard .github/workflows/openssf-scorecard.yml directory.
• Workflow Fix: This change addresses a previously non-functional workflow link, ensuring the OpenSSF Scorecard analysis runs correctly as intended.

Ignored Files

• Ignored by pattern: .github/workflows/** (2)
  • .github/workflows/openssf-scorecard.yml
  • .github/workflows/openssf-scorecard.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request removes the openssf-scorecard.yml workflow from the common directory. Based on the PR description and the linked failed action, the intent appears to be to stop centrally syncing this workflow, likely to resolve an issue where it was being incorrectly used as a reusable workflow. If this understanding is correct, the change is appropriate, but I suggest updating the PR title and description for clarity (e.g., "chore: Remove openssf-scorecard.yml from common sync").

My review of the deleted file's content found a critical error and a high-severity security issue that should be addressed if this workflow's logic is reused:

1. A critical issue with an invalid action version (github/codeql-action/upload-sarif@v4) that would cause the workflow to fail.
2. A high severity security risk, as actions are not pinned to specific commit SHAs, which is a best practice to prevent supply chain attacks.

I am having trouble creating individual review comments. Click here to see my feedback.

common/.github/workflows/openssf-scorecard.yml (47)

This step uses github/codeql-action/upload-sarif@v4, which is an invalid action reference. The latest major version for this action is v3. This will cause the workflow to fail.

Please use a valid version, for example v3. For improved security, it's also recommended to pin to a specific commit SHA.

        uses: github/codeql-action/upload-sarif@v3

common/.github/workflows/openssf-scorecard.yml (22-28)

As a security best practice, all GitHub Actions should be pinned to their full-length commit SHA. Using floating tags like @v4 or version tags like @v2.4.3 exposes the CI/CD pipeline to supply chain attacks if a tag is compromised. The OpenSSF Scorecard tool itself flags this under the Pinned-Dependencies check.

While the file is being deleted, if this content is reused, I strongly recommend updating all uses clauses to pin to a commit SHA.

For example:

• actions/checkout@v4 could become uses: actions/checkout@b4ffde65f46336ab11d5ea332401c1091c9f41d3 # v4.1.7
• ossf/[email protected] could become uses: ossf/scorecard-action@f505504259693f404d3589a6944ace132344c93c # v2.4.3

[henrywang]

/gemini review

[gemini-code-assist]

Code Review

This pull request removes the openssf-scorecard.yml workflow from the common/ directory. Based on the description, this is intended to fix a failing workflow. The change is straightforward, but the PR title 'Move openssf-scorecard.yml into .github/workflows' is a bit misleading since the file is being deleted, not moved. A title like 'Remove openssf-scorecard.yml from common files' might be clearer. I have added one comment on the deleted file regarding a security best practice for GitHub Actions which may be useful if you reuse this workflow's logic elsewhere.

[gemini-code-assist]

While this file is being removed, it's worth discussing the comment about not pinning actions by SHA digest. Pinning to a full-length commit SHA is a security best practice strongly recommended by the OpenSSF to prevent supply chain attacks. A git tag like v4 can be moved to point to a malicious commit, which would compromise your build. The OpenSSF Scorecard tool itself has a Pinned-Dependencies check that fails if dependencies are not pinned by hash. While managing SHAs can add some overhead, it significantly improves security and can be automated with tools like Dependabot.

[cgwalters]

The goal of having this in common/ is to actually sync it across repos though.

But yes, GH apparently not following symlinks for actions means it doesn't work here unless we:

• just duplicate the action
• change the sync process to sync to this repo too (not actually sure why it's omitted)
• change the sync process to look in this repo's .github for files with a magic comment like # infra: synchronized action