.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# CODEOWNERS reference: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# These owners will be the default owners for everything in
+# the repo. Unless a later match takes precedence,
+# the following users/teams will be requested for
+# review when someone opens a pull request.
+* @ossf/allstar-maintainers

.github/workflows/codeql.yml

@@ -0,0 +1,75 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '18 13 * * 6'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: go
+          build-mode: autobuild
+        # CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
+        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
+        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
+        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
+        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@2d790406f505036ef40ecba973cc774a50395aac # v3.25.13
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+    # If the analyze step fails for one of the languages you are analyzing with
+    # "We were unable to automatically build your code", modify the matrix above
+    # to set the build mode to "manual" for that language. Then modify this step
+    # to build your code.
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+    - if: matrix.build-mode == 'manual'
+      shell: bash
+      run: |
+        echo 'If you are using a "manual" build mode for one or more of the' \
+          'languages you are analyzing, replace this with the commands to build' \
+          'your code, for example:'
+        echo '  make bootstrap'
+        echo '  make release'
+        exit 1
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@2d790406f505036ef40ecba973cc774a50395aac # v3.25.13
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/postmerge.yaml

@@ -7,28 +7,19 @@ permissions:
   contents: read
   security-events: write
 jobs:
-  codeql:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v4
-    - uses: github/codeql-action/init@v3
-      with:
-        languages: go
-    - uses: github/codeql-action/autobuild@v3
-    - uses: github/codeql-action/analyze@v3
   scorecard:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: ossf/scorecard-action@v2.1.3
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
       with:
         results_file: results.sarif
         results_format: sarif
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
       with:
         name: SARIF file
         path: results.sarif
         retention-days: 5
-    - uses: github/codeql-action/upload-sarif@v3
+    - uses: github/codeql-action/upload-sarif@2d790406f505036ef40ecba973cc774a50395aac # v3.25.13
       with:
         sarif_file: results.sarif

.github/workflows/pr.yaml

@@ -6,28 +6,28 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-go@v4
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
       with:
         go-version: '1.21'
         check-latest: true
-    - uses: golangci/golangci-lint-action@v4
+    - uses: golangci/golangci-lint-action@a4f60bb28d35aeee14e6880718e0c85ff1882e64 # v6.0.1
       with:
         args: --timeout 3m --verbose
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-go@v4
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
       with:
         go-version: '1.21'
         check-latest: true
     - run: go build -v ./...
   test:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-go@v4
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
       with:
         go-version: '1.21'
         check-latest: true
@@ -36,5 +36,5 @@ jobs:
   dependency-review:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/dependency-review-action@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4

.github/workflows/release.yaml

@@ -14,16 +14,16 @@ jobs:
   release:
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
+      - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version: '1.21'
           check-latest: true
 
-      - uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
+      - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
 
-      - uses: ko-build/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6
+      - uses: ko-build/setup-ko@3aebd0597dc1e9d1a26bcfdb7cbeb19c131d3037 # v0.7
 
       - run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.workflow }} --password-stdin
 

CONTRIBUTING.md

@@ -12,25 +12,19 @@ Conduct.](https://openssf.org/community/code-of-conduct/)
 * When contributing large features, upate [whats-new.md](whats-new.md)
 * All git commits must have [DCO](https://wiki.linuxfoundation.org/dco)
 
-## Contribitor Ladder
+## Contributor Ladder
 
-[contributor-ladder.md](contributor-ladder.md)
+Allstar follows the [OpenSSF Scorecard contributor ladder](https://github.com/ossf/scorecard/blob/main/CONTRIBUTOR_LADDER.md).
+
+Details on the previous Allstar contributor ladder can be found [here](/contributor-ladder.md).
 
 ## Community
 
-Allstar is a project under the [OpenSSF](https://openssf.org/)
-[Securing Critical
-Projects](https://github.com/ossf/wg-securing-critical-projects)
-Working Group ([Mailing
-List](https://lists.openssf.org/g/openssf-wg-securing-crit-prjs)).
+Allstar is a part of the [OpenSSF Scorecard](https://github.com/ossf/scorecard) project.
 
-Allstar [Slack Channel](https://openssf.slack.com/#allstar) for
-discussion.
+We're hanging out in [#allstar](https://openssf.slack.com/archives/C02UQ2RL0HM) on the OpenSSF Slack workspace.
 
-Bi-weekly meetings are Thursdays, 1-2pm, Pacific time. See the
-[OpenSSF
-Calendar](https://calendar.google.com/calendar/u/0?cid=czYzdm9lZmhwNWk5cGZsdGI1cTY3bmdwZXNAZ3JvdXAuY2FsZW5kYXIuZ29vZ2xlLmNvbQ)
-for the invite.
+Meetings and additional community details are [here](https://github.com/ossf/scorecard#connect-with-the-scorecard-community).
 
 ## Development
 

MAINTAINERS.md

@@ -0,0 +1,23 @@
+# Maintainers
+
+## `allstar-maintainers`
+
+- @jeffmendoza
+
+## Contributors
+
+- @coheigea
+- @danielbankhead
+- @five510
+- @justaugustus
+- @markdboyd
+- @naveensrinivasan
+- @olivekl
+- @yorinasub17
+
+## Emeritus
+
+Former maintainers are listed here.
+Thanks for your contributions to Scorecard!
+
+- 

README.md

@@ -1,4 +1,4 @@
-[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/ossf/allstar/badge)](https://api.securityscorecards.dev/projects/github.com/ossf/allstar)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ossf/allstar/badge)](https://api.scorecard.dev/projects/github.com/ossf/allstar)
 
 <img align="right" src="artwork/openssf_allstar_alt.png" width="300" height="400">
 
@@ -54,9 +54,7 @@ that affect the security of your projects.  You can choose which security
 policies to monitor at both the organization and repository level, and how to
 handle policy violations.  You can also develop or contribute new policies.
 
-Allstar is developed under the [OpenSSF](https://openssf.org/) organization, as
-a part of the [Securing Critical Projects Working
-Group](https://github.com/ossf/wg-securing-critical-projects).
+Allstar is developed as a part of the [OpenSSF Scorecard](https://github.com/ossf/scorecard) project.
 
 ## [What's new with Allstar](whats-new.md)
 
@@ -323,8 +321,8 @@ here](https://pkg.go.dev/github.com/ossf/allstar/pkg/policies/workflow#OrgConfig
 
 This policy checks the GitHub Actions workflow configuration files
 (`.github/workflows`), for any patterns that match known dangerous
-behavior. See the [Security Scorecards
-Documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#dangerous-workflow)
+behavior. See the [OpenSSF Scorecard
+documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#dangerous-workflow)
 for more information on this check.
 
 ### Generic Scorecard Check
@@ -335,8 +333,8 @@ here](https://pkg.go.dev/github.com/ossf/allstar/pkg/policies/scorecard#OrgConfi
 
 This policy runs any scorecard check listed in the `checks` configuration. All
 checks run must have a score equal or above the `threshold` setting. Please see
-the [Security Scorecards
-Documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md)
+the [OpenSSF Scorecard
+documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md)
 for more information on each check.
 
 ### GitHub Actions

contributor-ladder.md

@@ -1,48 +1,29 @@
 # Contributor Ladder
 
-| Name | Prerequisites: Indicators to look for before promotion | Expectations | Recognition, Access, Effect of access |
-| - | - | - | - |
-| Contributors | One of: 1. Regular PRs for code/docs. 2. Regular feedback on discussion topics in issues/slack 3. Regular meeting attendance and contribution.  For a period of time: 30 days or more. | Continue pre-req. | Added as GitHub Outside Collaborator to repo with read permissions. Tests on PRs run automatically without approval |
-| Maintainers | Regular PRs for code/docs of moderate to substantial impact. Participates in many high-level proposals and discussions. | Available to have PRs assigned to them for review: Will review within 3 business days, otherwise notifies team when unable to review (ooo, etc.) Responds to requests for input/discussion over issues and slack | Added as GitHub Outside Collaborator to repo with write/push access. Approves and merges PRs |
-| Leaders | Consistently drives the project through code, proposals, project direction, leadership, etc. | As a group, responds and makes final decisions through consensus on all large proposals, features, architecture changes, design, documentation of project | Full access and ownership. Creates releases, and finalizes changelog updates, sends project update announcements. |
-
-## Promotion Process
-
-Please submit a PR to this file with the promotion proposed, and include
-evidence of the proposed member meeting the prerequisites. The proposed member
-must agree to uphold the expectations of the new level. The existing
-Maintainers and Leaders will reach consensus that the prerequites are met and
-merge the PR.
+***Allstar follows the [OpenSSF Scorecard contributor ladder](https://github.com/ossf/scorecard/blob/main/CONTRIBUTOR_LADDER.md).***
 
-### Appeals
+Contributors to Allstar are documented in [MAINTAINERS.md](/MAINTAINERS.md).
 
-Appeals will be discussed as a meeting agneda item in the [Securing Critical
-Projects](https://github.com/ossf/wg-securing-critical-projects) Working
-Group. Please see the WG page for meeting times.
+Appeals will be discussed as an agenda item in the [OpenSSF Scorecard project meetings](https://github.com/ossf/scorecard#connect-with-the-scorecard-community).
 
-## Current list
+## Changes
 
-### Contributors
+This section briefly details key differences between the OpenSSF Scorecard contributor ladder and the legacy Allstar contributor ladder.
 
-- @coheigea
-- @danielbankhead
-- @five510
-- @justaugustus
-- @markdboyd
-- @naveensrinivasan
-- @olivekl
-- @yorinasub17
+- *Active* legacy "Contributors" who are not OpenSSF GitHub organization members are now ["Community Members"](https://github.com/ossf/scorecard/blob/main/CONTRIBUTOR_LADDER.md#community-members)
+  - Community Members are eligible for [OpenSSF GitHub organization](https://github.com/ossf) membership. Outside collaborator access [***should never be granted***](https://github.com/ossf/tac/blob/main/policies/access.md#teams-not-individuals).
+- Existing OpenSSF GitHub organization members who are actively reviewing content can be granted [Triagers access](https://github.com/ossf/scorecard/blob/main/CONTRIBUTOR_LADDER.md#triagers)
+- Legacy "Maintainers" and "Leaders" are now considered equivalent [access levels][maintainers-access]
+- Existing OpenSSF Scorecard maintainers may be granted [Maintainer access][maintainers-access], based on need
 
-### Maintainers
+[maintainers-access]: https://github.com/ossf/scorecard/blob/main/CONTRIBUTOR_LADDER.md#maintainers
 
-### Leaders
+## Legacy contributor ladder
 
-- @jeffmendoza
+This section exists for historical purposes to detail the legacy Allstar contributor ladder, ***which is no longer in use***.
 
-## Notes
-
-- Only "outside collaborator" access is included above. We would like
-  to determine OpenSSF GitHub Org membership requirements and add that
-  at the Maintainer level.
-
-- Please suggest more recognition items for the Contributor level.
+| Name | Prerequisites: Indicators to look for before promotion | Expectations | Recognition, Access, Effect of access |
+| - | - | - | - |
+| Contributors | One of: 1. Regular PRs for code/docs. 2. Regular feedback on discussion topics in issues/slack 3. Regular meeting attendance and contribution.  For a period of time: 30 days or more. | Continue pre-req. | Added as GitHub Outside Collaborator to repo with read permissions. Tests on PRs run automatically without approval |
+| Maintainers | Regular PRs for code/docs of moderate to substantial impact. Participates in many high-level proposals and discussions. | Available to have PRs assigned to them for review: Will review within 3 business days, otherwise notifies team when unable to review (ooo, etc.) Responds to requests for input/discussion over issues and slack | Added as GitHub Outside Collaborator to repo with write/push access. Approves and merges PRs |
+| Leaders | Consistently drives the project through code, proposals, project direction, leadership, etc. | As a group, responds and makes final decisions through consensus on all large proposals, features, architecture changes, design, documentation of project | Full access and ownership. Creates releases, and finalizes changelog updates, sends project update announcements. |