Google On-line Safety Weblog: Lowering Safety Dangers in Open Supply Software program at Scale: Scorecards Launches V4

Posted by Laurent Simon and Azeem Shaikh, Google Open Supply Safety Workforce (GOSST) Since our July announcement of Scorecards V2, the Scorecards mission—an automatic safety instrument to flag dangerous provide chain practices in open supply initiatives—has grown steadily to over 40 distinctive contributors and 18 carried out safety checks. Right this moment we’re proud to announce the V4 launch of Scorecards, with bigger scaling, a brand new safety examine, and a brand new Scorecards GitHub Motion for simpler safety automation.

The Scorecards Motion is launched in partnership with GitHub and is obtainable from GitHub’s Market. The Motion makes utilizing Scorecards simpler than ever: it runs routinely on repository modifications to alert builders about dangerous supply-chain practices. Maintainers can view the alerts on GitHub’s code scanning dashboard, which is obtainable without spending a dime to public repositories on GitHub.com and by way of GitHub Superior Safety for personal repositories.

Moreover, we have now scaled our weekly Scorecards scans to over a million GitHub repositories, and have partnered with the Open Supply Insights web site for simple person entry to the info.

For extra particulars concerning the launch, together with the brand new Harmful-Workflow safety examine, go to the OpenSSF’s official weblog submit right here.