OSSF Best Practices

[willfarrell]

https://scorecard.dev/viewer/?uri=github.com/middyjs/middy

• 0 Code-Review
  • Don't have enough active maintainers to be able to achieve this
• 8 Branch-Protection
  • Warn: required approving review count is 1 on branch 'main'
  • Don't have enough active maintainers to increase this
• 5 CII-Best-Practice
  • enforce signed commits
  • https://www.bestpractices.dev/en/projects/5280?criteria_level=1
    • Add in DCO https://github.com/dcoapp/app
      • https://medium.com/@michaelyuan_88928/a-complete-guide-to-dco-for-open-source-developers-fa063c17d9e7
    • Document governance model
      • Examples: https://www.zotero.org/groups/2310183/foss_governance/collections/ZQ2QXSWW/items/EJGXHVXX/collection
      • Example: https://github.com/spdx/governance
      • Example: https://github.com/coreinfrastructure/best-practices-badge/blob/main/docs/vetting.md
    • Document key roles
    • Document threat modeling
  • https://www.bestpractices.dev/en/projects/5280?criteria_level=2
    • Add copyright to all files
    • Add licence to all files
• ? Signed-Releases
  • False omission, may not work for mono-repos at this time
  • Feature: Improve Signed-release for npm package ossf/scorecard#3038
  • https://github.com/middyjs/middy/blob/main/.github/workflows/release.yml#L49
  • https://github.com/slsa-framework/slsa-github-generator/tree/main/actions/nodejs/publish