From 3d5bbaeb4c0b18c07cf3ff49f88f1c48ef366582 Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Tue, 4 Aug 2026 17:05:14 +0200 Subject: [PATCH] CI: adds Plumber workflow security check Runs the Plumber CLI on pushes to dev and master and on pull requests. It statically checks the workflows under .github/workflows for supply chain risks (unpinned third-party actions, missing token permission scopes, secrets handed to workflows that do not need them) and uploads a SARIF report so findings show up in the Security tab. The gate passes at 85 of 100 points, so one small finding does not block PRs. The .plumber.yaml overlay inherits the tool's built-in baseline and only records what differs for this repo: the niche platform actions the BSD, Solaris and arch-emulation builds rely on are trusted on top of the curated default source list. The README badge works like OpenSSF Scorecard's published results and shows the current score of the default branch. --- .github/workflows/plumber.yml | 36 +++++++++++++++++++++++++++++++++++ .plumber.yaml | 20 +++++++++++++++++++ README.md | 1 + 3 files changed, 57 insertions(+) create mode 100644 .github/workflows/plumber.yml create mode 100644 .plumber.yaml diff --git a/.github/workflows/plumber.yml b/.github/workflows/plumber.yml new file mode 100644 index 0000000000..0454b6dafd --- /dev/null +++ b/.github/workflows/plumber.yml @@ -0,0 +1,36 @@ +name: Plumber + +on: + push: + branches: [dev, master] + pull_request: + +permissions: + contents: read + +jobs: + plumber: + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read + security-events: write + # Needed by score-push to publish the score for the README badge. + id-token: write + steps: + - name: checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: run plumber + uses: getplumber/plumber@40bd6b5bb8ff4f0944feacaeb41dea6bce08d62d # v0.4.28 + with: + # Code scanning upload needs security-events write, which PRs + # from forks do not get. The report stays available as a + # workflow artifact there. + upload-sarif: ${{ github.event.pull_request.head.repo.fork != true }} + # Publishes the score to score.getplumber.io, which feeds the + # badge in the README. A failed push never fails the run. + score-push: true + # Gate at 85 points instead of the all-or-nothing default, + # leaves room for a small finding without blocking PRs. + min-points: 85 diff --git a/.plumber.yaml b/.plumber.yaml new file mode 100644 index 0000000000..acede2fcee --- /dev/null +++ b/.plumber.yaml @@ -0,0 +1,20 @@ +# Plumber overlay: inherits every control from the CLI's built-in +# baseline, only the differences for this repo are written here. +# Run 'plumber config resolve' to see the full effective config. +extends: plumber:default +version: "2.0" + +github: + controls: + githubActionMustComeFromAuthorizedSources: + # Keep the curated default list and trust the niche platform + # actions this repo already relies on for its BSD, Solaris and + # arch-emulation builds, plus the release helpers. + includePlumberDefaults: true + trustedGithubActions: + - cross-platform-actions/action + - jirutka/setup-alpine + - ncipollo/release-action + - pozetroninc/github-action-get-latest-release + - uraimo/run-on-arch-action + - vmactions/solaris-vm diff --git a/README.md b/README.md index d2b0a53d92..c39f7f6a98 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,7 @@ [![GitHub release (with filter)](https://img.shields.io/github/v/release/fastfetch-cli/fastfetch?logo=github)](https://github.com/fastfetch-cli/fastfetch/releases) [![latest packaged version(s)](https://repology.org/badge/latest-versions/fastfetch.svg)](https://repology.org/project/fastfetch/versions) [![Packaging status](https://repology.org/badge/tiny-repos/fastfetch.svg)](https://repology.org/project/fastfetch/versions) +[![Plumber Score](https://score.getplumber.io/github.com/fastfetch-cli/fastfetch.svg)](https://score.getplumber.io/github.com/fastfetch-cli/fastfetch) [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/fastfetch-cli/fastfetch) [![中文README](https://img.shields.io/badge/%E4%B8%AD%E6%96%87-README-red)](README-cn.md)