Increasing the OpenSSF Scorecard results

[UlisesGascon]

Enter your suggestions in details:

The @nodejs/security team is running an initiative to improve the OpenSSF Scorecard results at organization level (nodejs/security-wg#859). In the last security team meeting we had discussed about the current scoring for the nodejs/nodejs.org repository. Seems like there is a decrease of -1.7 points since the last review (2 weeks ago)

Repository	Commit	Score	Score Delta	Report	StepSecurity
nodejs/nodejs.org	1fbd908	6.4	-1.7 / Details	View	Fix it

In this recorded video you can see the analysis from the team (relevant from 05:08 to 14:53). Also the relevant notes from the meeting.

Here are the highlighted parts from the Delta Analysis:

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged

• Reasoning: found 11 unreviewed changesets out of 23 -- score normalized to 5
• Previous revision reasoning: found 5 unreviewed changesets out of 30 -- score normalized to 8
• Documentation

Dangerous-Workflow

Determines if the project's github action workflows avoid dangerous patterns

Warn: untrusted code checkout '${{ github.event.pull_request.base.ref }}': .github/workflows/pull-request-target.yml:38
Warn: untrusted code checkout '${{ github.event.pull_request.base.ref }}': .github/workflows/pull-request-target.yml:82
Warn: untrusted code checkout '${{ github.event.pull_request.base.ref }}': .github/workflows/pull-request-target.yml:125

• Code reference
• Documentation

Next steps

• Open PRs with some quick win improvements (Codeql, deps reviwew...) @UlisesGascon
  • add scorecard pipeline #5660
  • add scorecard badge #5661
  • add dependency review #5662
  • add codeql pipeline #5663
• Discuss about the relevant things that came out from the delta analysis.

[ovflowd]

I kinda disagree with the reasoning imposed here. Yes, we are checking out code, but supposedly only the "base" refs for a given PR, which usually mean that the base branch of this repository is used.

Also I wonder if on forks it would checkout the base ref of the fork or our repository.

Anyhow, I need to understand the reasoning why checking out the base branch ref is unsafe, as it is actually the recommended approach by GitHub to stay safe.

[ovflowd]

@UlisesGascon scores went up to 8.6 :)

So... closing as the scores went up 🎉