|
20 | 20 | * [[Job] build](#job-build) |
21 | 21 | * [[Job] AppInspect](#job-appinspect) |
22 | 22 | * [[Job] AppInspect API](#job-appinspect-api) |
| 23 | + * [[Job] run-gs-scorecard](#job-run-gs-scorecard) |
23 | 24 | * [[Job] setup](#job-setup) |
24 | 25 | * [[Job] test-unit-python3](#job-test-unit-python3) |
25 | 26 | * [[Job] run-btool-check](#job-run-btool-check) |
@@ -523,6 +524,46 @@ appinspect-api-html-report-self-service |
523 | 524 | ``` |
524 | 525 |
|
525 | 526 |
|
| 527 | +## [Job] run-gs-scorecard |
| 528 | + |
| 529 | +**Description** |
| 530 | + |
| 531 | +- This job runs the Gold Standard Scorecard quality assessment tool to evaluate the add-on against security and quality standards. |
| 532 | + |
| 533 | +- The GS Scorecard tool is containerized and runs in a Docker container, analyzing the repository and generating a comprehensive quality report. |
| 534 | + |
| 535 | +- This job only runs on push events to the `main` branch after a successful build. |
| 536 | + |
| 537 | +**Action used:** |
| 538 | +- AWS ECR (Elastic Container Registry) for Docker image storage |
| 539 | +- Custom Docker image: `ta-automation/gs-scorecard` pushed from GitLab GS Scorecard repository |
| 540 | + |
| 541 | +**Pass/fail behaviour:** |
| 542 | + |
| 543 | +- The job executes the GS Scorecard analysis and generates a quality report. |
| 544 | + |
| 545 | +- The job requires proper AWS credentials for accessing the ECR registry and GitHub credentials for repository analysis. |
| 546 | + |
| 547 | +**Troubleshooting steps for failures if any:** |
| 548 | + |
| 549 | +- Verify that the required secrets are properly configured in GitHub Actions: |
| 550 | + - `GSSA_AWS_ACCESS_KEY_ID` and `GSSA_AWS_SECRET_ACCESS_KEY` for AWS ECR access |
| 551 | + - `GH_TOKEN_ADMIN` and `SA_GH_USER_NAME` for GitHub access |
| 552 | + - `SPL_COM_USER` and `SPL_COM_PASSWORD` for AppInspect integration |
| 553 | + |
| 554 | +- Check that the Docker image version specified in `GS_SCORECARD_VERSION` environment variable exists in the ECR registry. |
| 555 | + |
| 556 | +- Review the job logs for specific error messages from the GS Scorecard tool. |
| 557 | + |
| 558 | +- Ensure the build job completed successfully before this job runs, as it depends on the build artifacts. |
| 559 | + |
| 560 | +**Artifacts:** |
| 561 | + |
| 562 | +``` |
| 563 | +gs-scorecard-report (gs_scorecard.html) |
| 564 | +``` |
| 565 | + |
| 566 | + |
526 | 567 | ## [Job] setup |
527 | 568 |
|
528 | 569 | **Description:** |
|
0 commit comments