Skip to content

Commit 4a8117a

Browse files
AlexanderBarabanovAlexanderBarabanov
authored
🔧 chore(ci): enable Renovate and OpenSSF Scorecard reports (#2845)
* enable renovate Signed-off-by: Barabanov <alexander.barabanov@intel.com> * disable dependabot Signed-off-by: Barabanov <alexander.barabanov@intel.com> * all deps Signed-off-by: Barabanov <alexander.barabanov@intel.com> * disable python upgrade Signed-off-by: Barabanov <alexander.barabanov@intel.com> * added Zizmor Signed-off-by: Barabanov <alexander.barabanov@intel.com> * added Zizmor Signed-off-by: Barabanov <alexander.barabanov@intel.com> * fix format Signed-off-by: Barabanov <alexander.barabanov@intel.com> * format Signed-off-by: Barabanov <alexander.barabanov@intel.com> * enable custom regexp Signed-off-by: Barabanov <alexander.barabanov@intel.com> * style Signed-off-by: Barabanov <alexander.barabanov@intel.com> * remove unnecessary block Signed-off-by: Barabanov <alexander.barabanov@intel.com> * added OpenSSF bage Signed-off-by: Barabanov <alexander.barabanov@intel.com> * added description Signed-off-by: Barabanov <alexander.barabanov@intel.com> * style Signed-off-by: Barabanov <alexander.barabanov@intel.com> --------- Signed-off-by: Barabanov <alexander.barabanov@intel.com>
1 parent 5966423 commit 4a8117a

File tree

9 files changed

+302
-33
lines changed

9 files changed

+302
-33
lines changed

‎.github/actions/security/zizmor/action.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,8 @@ inputs:
5151
zizmor-version:
5252
description: "Zizmor version"
5353
required: false
54-
default: "1.9.0"
54+
# renovate: datasource=github-releases depName=zizmorcore/zizmor
55+
default: 1.9.0
5556

5657
outputs:
5758
scan_result:

‎.github/dependabot.yml

Lines changed: 0 additions & 21 deletions
This file was deleted.

‎.github/renovate.json5

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
// Dependency Update Configuration
2+
//
3+
// See https://docs.renovatebot.com/configuration-options/
4+
// See https://json5.org/ for JSON5 syntax
5+
6+
// [!] While updating the Renovate config, test changes on your own fork.
7+
// 1. Modify the Renovate configuration, which is located in .github/renovate.json5 and push your changes to the default branch of your fork.
8+
// 2. Enable the Renovate GitHub app in your GitHub account.
9+
// Verify that Renovate is activated in the repository settings within the Renovate Dashboard.
10+
// To enable the dashboard set `dependencyDashboard` to true
11+
// 3. Trigger the Renovate app from the dashboard, or push a new commit to your fork’s default branch to re-trigger Renovate.
12+
// 4. Use the dashboard to initiate Renovate and create a PR on your fork, then check that the proposed PRs are modifying the correct parts.
13+
// 5. Once you’ve validated that the Renovate configuration works on your fork, submit a PR,
14+
// and include links in the description to share details about the testing you've conducted.
15+
16+
{
17+
$schema: "https://docs.renovatebot.com/renovate-schema.json",
18+
19+
// regenerate lock weekly https://docs.renovatebot.com/configuration-options/#lockfilemaintenance
20+
lockFileMaintenance: {
21+
enabled: true,
22+
schedule: ["* * * * 0"], // weekly
23+
},
24+
25+
extends: ["config:base", ":gitSignOff", "helpers:pinGitHubActionDigests"],
26+
// https://docs.renovatebot.com/presets-default/#gitsignoff
27+
// https://docs.renovatebot.com/presets-helpers/#helperspingithubactiondigests
28+
29+
// if necessary, add supported releases branches here
30+
// it is possible to enable/disable specific upgrades per branch with
31+
// `matchBaseBranches` in specific rule
32+
baseBranches: ["main"],
33+
34+
enabledManagers: ["github-actions", "pep621", "custom.regex"],
35+
36+
// Set limit to 10
37+
ignorePresets: [":prHourlyLimit2"],
38+
prHourlyLimit: 10,
39+
40+
packageRules: [
41+
// weekly dependencies upgrades
42+
{
43+
enabled: true,
44+
matchManagers: ["pep621"],
45+
schedule: ["* * * * 0"], // weekly
46+
},
47+
48+
// Python version is upgraded manually
49+
{
50+
enabled: false,
51+
matchDatasources: ["python-version"],
52+
matchDepNames: ["python"],
53+
matchDepTypes: ["requires-python"],
54+
},
55+
56+
// disable open-clip-torch upgrades as
57+
// open-clip-torch throws error on v2.26.1
58+
{
59+
enabled: false,
60+
matchDatasources: ["pypi"],
61+
matchDepNames: ["open-clip-torch"],
62+
matchDepTypes: ["project.optional-dependencies"],
63+
},
64+
65+
// Group GitHub Actions updates
66+
{
67+
enabled: true,
68+
separateMajorMinor: false,
69+
groupName: "GitHub Actions",
70+
matchManagers: ["github-actions"],
71+
matchPackagePatterns: ["*"],
72+
schedule: ["* * 1 * *"], // every month
73+
},
74+
75+
// Python version used in GitHub Actions is updated manually
76+
{
77+
enabled: false,
78+
matchDatasources: ["github-releases"],
79+
matchDepNames: ["python"],
80+
matchDepTypes: ["uses-with"],
81+
},
82+
],
83+
84+
// is used to upgrade Zizmor version
85+
customManagers: [
86+
{
87+
fileMatch: ["^\\.github/actions/security/zizmor/[^/]+\\.ya?ml$"],
88+
// https://docs.renovatebot.com/modules/manager/regex/#advanced-capture
89+
matchStrings: [
90+
"# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+.+default: (?<currentValue>.*)",
91+
],
92+
},
93+
],
94+
95+
// Enable security upgrades
96+
vulnerabilityAlerts: {
97+
enabled: true,
98+
},
99+
osvVulnerabilityAlerts: true,
100+
dependencyDashboard: true,
101+
}

‎.github/workflows/_reusable-security-scan.yaml

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -115,16 +115,6 @@ jobs:
115115
fetch-depth: 0 # Required for changed files detection
116116
persist-credentials: false
117117

118-
# These steps are required to lock dependencies in requirements.txt that will by used by Trivy
119-
- name: Set up Python
120-
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
121-
with:
122-
python-version: "3.10"
123-
- name: Install dependencies
124-
run: python -m pip install pip-tools
125-
- name: Freeze dependencies
126-
run: pip-compile --extra=full -o requirements.txt pyproject.toml
127-
128118
- name: Run Trivy scan
129119
id: trivy
130120
uses: ./.github/actions/security/trivy

‎.github/workflows/renovate-config-validator.yml

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Renovate configuration validator
2+
#
3+
# This workflow validates changes proposed into Renovate configuration file,
4+
# located .github/renovate.json5.
5+
#
6+
# Key Features:
7+
# - Validate changes and prevent non-valid configuration to be used by Renovate.
8+
#
9+
# Process Stages:
10+
# Configuration validation:
11+
# - Runs on PR into .github/renovate.json5 and validate changes.
12+
#
13+
# Required Secrets:
14+
# - None
15+
#
16+
# Example Usage:
17+
# Automatically triggered on:
18+
# - Pull requests to .github/renovate.json5.
19+
#
20+
# Note: None.
21+
22+
name: Validate Renovate configuration
23+
24+
on:
25+
pull_request:
26+
paths:
27+
- ".github/renovate.json5"
28+
29+
permissions:
30+
contents: read
31+
32+
concurrency:
33+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.after }}
34+
cancel-in-progress: true
35+
36+
jobs:
37+
validate:
38+
runs-on: ubuntu-latest
39+
steps:
40+
- name: Checkout configuration
41+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
42+
with:
43+
persist-credentials: false
44+
45+
- name: Validate configuration
46+
run: |
47+
# renovate: datasource=docker
48+
export RENOVATE_IMAGE=ghcr.io/renovatebot/renovate:40.11
49+
docker run --rm --entrypoint "renovate-config-validator" \
50+
-v "${{ github.workspace }}/.github/renovate.json5":"/renovate.json5" \
51+
${RENOVATE_IMAGE} "/renovate.json5"

‎.github/workflows/renovate.yml

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
# Dependencies Management Workflow
2+
#
3+
# This workflow automates the dependence management based on self-hosed Renovate
4+
# ensure the project's dependencies remains up-to-date and
5+
# security fixes are delivered regularly.
6+
#
7+
# Key Features:
8+
# - Automated PR creation into pyproject.toml and uv.lock regeneration
9+
# - Dry-run for debug purposes
10+
# - Dependency dashboard (is available in GitHub issues) maintenance
11+
#
12+
# Process Stages:
13+
#
14+
# 1. Dependencies Management:
15+
# - Runs on a daily schedule.
16+
# - Identifies dependencies that may be updated based on .github/renovate.json5 configuration.
17+
# - Opens corresponding PRs with respect to schedule defined in Renovate config file.
18+
# - Updates Renovate Dependency dashboard that is available in GitHub issues.
19+
#
20+
# Required Secrets:
21+
# - RENOVATE_APP_ID: application ID
22+
# - RENOVATE_APP_PEM: application private key
23+
#
24+
# Example Usage:
25+
# 1. Scheduled Run:
26+
# Automatically runs, daily
27+
#
28+
# 2. Manual Trigger:
29+
# workflow_dispatch:
30+
# inputs:
31+
# dry-run:
32+
# description: "Run Renovate in dry-run mode (no PR)"
33+
# required: false
34+
# default: false
35+
# type: boolean
36+
#
37+
# Note: Renovate maintains and updates Dependency dashboard that is available in GitHub issues.
38+
39+
name: Renovate
40+
on:
41+
schedule:
42+
# daily
43+
- cron: "0 2 * * *"
44+
45+
# allow to manually trigger this workflow
46+
workflow_dispatch:
47+
inputs:
48+
dry-run:
49+
description: "Run Renovate in dry-run mode (no PR)"
50+
required: false
51+
default: false
52+
type: boolean
53+
54+
permissions: {}
55+
56+
jobs:
57+
renovate:
58+
permissions:
59+
contents: read
60+
runs-on: ubuntu-latest
61+
62+
steps:
63+
- name: Checkout
64+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
65+
with:
66+
persist-credentials: false
67+
68+
- name: Get token
69+
id: get-github-app-token
70+
uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
71+
with:
72+
app-id: ${{ secrets.RENOVATE_APP_ID }}
73+
private-key: ${{ secrets.RENOVATE_APP_PEM }}
74+
75+
- name: Self-hosted Renovate
76+
uses: renovatebot/github-action@13f127373fd3dc43b41b0979e37ba570d6c2b8f4 # v43.0.0
77+
with:
78+
configurationFile: .github/renovate.json5
79+
token: "${{ steps.get-github-app-token.outputs.token }}"
80+
env:
81+
LOG_LEVEL: ${{ github.event_name == 'workflow_dispatch' && 'debug' || 'info' }}
82+
# Dry run if the event is workflow_dispatch AND the dry-run input is true
83+
RENOVATE_DRY_RUN: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.dry-run == 'true') && 'full' || null }}
84+
RENOVATE_PLATFORM: github
85+
RENOVATE_REPOSITORIES: ${{ github.repository }}

‎.github/workflows/scorecards.yml

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# OpenSSF Scorecard Checks Workflow
2+
#
3+
# This workflow uses ossf/scorecard-action action to check repo based on
4+
# OpenSSF Scorecard requirements / best practices
5+
#
6+
# Key Features:
7+
# - Check the repo based on OpenSSF Scorecard requirements
8+
# - Upload results into Security tab and OpenSSF
9+
# - Scheduled daily scans
10+
#
11+
# Process Stages:
12+
# 1. Scheduled Execution (Daily at 2 AM UTC)
13+
# 2. Manual Execution
14+
#
15+
# Required Permissions:
16+
# - id-token: write
17+
# - security-events: write
18+
#
19+
# Note: Results are available in the Security tab and
20+
# https://scorecard.dev/viewer/?uri=github.com/open-edge-platform/anomalib
21+
22+
name: Scorecards supply-chain security
23+
on:
24+
# For Branch-Protection check. Only the default branch is supported. See
25+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
26+
branch_protection_rule:
27+
schedule:
28+
# Run security checks every day at 2 AM UTC
29+
- cron: "0 2 * * *"
30+
workflow_dispatch:
31+
32+
permissions: {}
33+
34+
jobs:
35+
analysis:
36+
name: Scorecards analysis
37+
runs-on: ubuntu-latest
38+
permissions:
39+
# Needed to upload the results to code-scanning dashboard
40+
security-events: write
41+
# Needed to publish results and get a badge
42+
id-token: write
43+
44+
steps:
45+
- name: Checkout code
46+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
47+
with:
48+
persist-credentials: false
49+
50+
- name: Run analysis
51+
uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
52+
with:
53+
results_file: results.sarif
54+
results_format: sarif
55+
publish_results: true
56+
57+
# Upload the results to GitHub's code scanning dashboard
58+
- name: Upload to code-scanning
59+
uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
60+
with:
61+
sarif_file: results.sarif

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
[![codecov](https://codecov.io/gh/open-edge-platform/anomalib/branch/main/graph/badge.svg?token=Z6A07N1BZK)](https://codecov.io/gh/open-edge-platform/anomalib)
2121
[![Downloads](https://static.pepy.tech/personalized-badge/anomalib?period=total&units=international_system&left_color=grey&right_color=green&left_text=PyPI%20Downloads)](https://pepy.tech/project/anomalib)
2222
[![snyk](https://snyk.io/advisor/python/anomalib/badge.svg)](https://snyk.io/advisor/python/anomalib)
23+
[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/8330/badge)](https://www.bestpractices.dev/projects/8330)
2324

2425
[![ReadTheDocs](https://readthedocs.org/projects/anomalib/badge/?version=latest)](https://anomalib.readthedocs.io/en/latest/?badge=latest)
2526
[![Anomalib - Gurubase docs](https://img.shields.io/badge/Gurubase-Ask%20Anomalib%20Guru-006BFF)](https://gurubase.io/g/anomalib)

‎docs/source/examples

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
../../examples
1+
../../examples

0 commit comments

Comments
 (0)