Skip to content

📖document OpenSSF Scorecard and Trivy image scanning workflows #572

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mrhapile wants to merge 1 commit into
base: main
Choose a base branch
from
Open

📖document OpenSSF Scorecard and Trivy image scanning workflows #572

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions docs/content/direct/testing.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,3 +41,32 @@ See `test/e2e/` in the GitHub repository. It has a README.
## Testing releases

See [the release testing doc](release-testing.md).

## CI security scanning

KubeStellar uses automated security scanning workflows as part of its
continuous integration (CI) pipeline to improve supply-chain security
and provide early visibility into potential vulnerabilities.

### OpenSSF Scorecard

An OpenSSF Scorecard workflow is used to evaluate the repository against
a set of security best practices, such as branch protection, dependency
management, and CI configuration.

When enabled, this workflow typically runs on a schedule and/or on
changes to the main branch. The results are published to the GitHub
**Security** tab.
Comment on lines +57 to +59
Copy link

Copilot AI Jan 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The phrase "When enabled" is ambiguous and may confuse readers about whether the OpenSSF Scorecard workflow is currently active in the KubeStellar project. Consider rephrasing to clearly indicate the workflow's current status, such as "This workflow runs on a schedule and/or on changes to the main branch" if it's currently active, or explicitly stating "If enabled in the future" if it's not yet active.

Suggested change
When enabled, this workflow typically runs on a schedule and/or on
changes to the main branch. The results are published to the GitHub
**Security** tab.
This workflow runs on a schedule and/or on changes to the main branch.
The results are published to the GitHub **Security** tab.

Copilot uses AI. Check for mistakes.

### Trivy image scanning

KubeStellar also uses Trivy to scan container images built in CI for
known vulnerabilities (CVEs).

A Trivy-based workflow reports **CRITICAL** and **HIGH** severity
findings and uploads results in SARIF format, making them visible in the
GitHub **Security** tab.

These security scanning workflows are part of the project’s CI
infrastructure only and do not affect the runtime behavior of
KubeStellar deployments.
Loading