Story (Required)

This story captures the identification and resolution of issues found during the review of the countermeasures, ensuring that all necessary improvements are implemented to strengthen OpenShift Pipelines’ security.

Background (Required)

https://issues.redhat.com/browse/SRVKP-4185

Out of scope

<Defines what is not included in this story>

Approach (Required)

<Description of the general technical path on how to achieve the goal of the story. Include details like json schema, class definitions>

Dependencies

<Describes what this story depends on. Dependent Stories and EPICs should be linked to the story.>

Acceptance Criteria (Mandatory)

1. Ensure appropriate gosec validation with required include/exclude rules are added as github workflow action (https://github.com/securego/gosec?tab=readme-ov-file#github-action).
2. The gosec assessment is based on main branch of each assessed repository. The same has to evaluated/cherry-picked to the branches that include supported version of code.
3. Adopt OpenSSF scorecard and OpenSSF best practices and indicate the status in README. Sample from https://github.com/ossf/scorecard.git :   
4. Address the reported findings specific to the component:

• Assessment outcome for T60(https://issues.redhat.com/browse/SRVKP-4378) - https://docs.google.com/spreadsheets/d/1_VouLO0o8l-i1asenzqu9m20hOIhVqPerW0wkhM6-Gc/edit?usp=sharing
•  Assessment outcome for T281(https://issues.redhat.com/browse/SRVKP-6542) -  https://docs.google.com/document/d/1uvUW68G_t0rhvvtT2DU5R_05mcvESdhv3Vb0ya8vv7U/edit?usp=sharing

INVEST Checklist

Dependencies identified

Blockers noted and expected delivery timelines set

Design is implementable

Acceptance criteria agreed upon

Story estimated

Legend

Unknown

Verified

Unsatisfied

Done Checklist

• Code is completed, reviewed, documented and checked in
• Unit and integration test automation have been delivered and running cleanly in continuous integration/staging/canary environment
• Continuous Delivery pipeline(s) is able to proceed with new code included
• Customer facing documentation, API docs etc. are produced/updated, reviewed and published
• Acceptance criteria are met