ci: Add OpenSSF Scorecard workflow and gitleaks pre-commit hook

[step-security-bot]

Summary

This pull request is created by StepSecurity at the request of @Pr0methean. Please merge the Pull Request to incorporate the requested changes. Please tag @Pr0methean on your message if you have any questions related to the PR.

Security Fixes

Least Privileged GitHub Actions Token Permissions

The GITHUB_TOKEN is an automatically generated secret to make authenticated calls to the GitHub API. GitHub recommends setting minimum token permissions for the GITHUB_TOKEN.

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

Pinned Dependencies

GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

Add OpenSSF Scorecard Workflow

OpenSSF Scorecard is an automated tool that assesses a number of important heuristics ("checks") associated with software security and assigns each check a score of 0-10. You can use these scores to understand specific areas to improve in order to strengthen the security posture of your project.

Scorecard workflow also allows maintainers to display a Scorecard badge on their repository to show off their hard work.

• The Open Source Security Foundation (OpenSSF) Scorecard

Maintain Code Quality with Pre-Commit

Pre-commit is a framework for managing and maintaining multi-language pre-commit hooks. Hooks can be any scripts, code, or binaries that run at any stage of the git workflow. Pre-commit hooks are useful for enforcing code quality, code formatting, and detecting security vulnerabilities.

• Official Pre-commit documentation
• Getting Started guide

Feedback

For bug reports, feature requests, and general feedback; please email support@stepsecurity.io. To create such PRs, please visit https://app.stepsecurity.io/securerepo.

Signed-off-by: StepSecurity Bot bot@stepsecurity.io

[gemini-code-assist]

Summary of Changes

Hello @step-security-bot, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request, initiated by the StepSecurity bot at the request of @Pr0methean, focuses on enhancing the repository's security and code quality. It introduces a new .pre-commit-config.yaml file to configure automated checks before code is committed. The primary additions include integrating gitleaks for secret detection and incorporating end-of-file-fixer and trailing-whitespace hooks to maintain consistent code formatting. While the PR title mentions an OpenSSF Scorecard workflow, the provided patch specifically implements the pre-commit hook configurations.

Highlights

• New Pre-Commit Configuration: A new .pre-commit-config.yaml file has been added to the repository to manage and enforce pre-commit hooks.
• Gitleaks Integration: The gitleaks tool (v8.16.3) has been integrated as a pre-commit hook to automatically detect and prevent sensitive information and secrets from being committed to the repository.
• Code Formatting Hooks: Two standard pre-commit hooks, end-of-file-fixer and trailing-whitespace (both from pre-commit-hooks v4.4.0), have been added to ensure consistent file formatting and remove unnecessary whitespace.

Ignored Files

• Ignored by pattern: .github/workflows/** (3)
  • .github/workflows/ci.yaml
  • .github/workflows/release-plz.yml
  • .github/workflows/scorecards.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request adds a pre-commit configuration with gitleaks for secret scanning and other hooks for code quality. This is a valuable addition for maintaining repository health. My review focuses on the versions of the dependencies used in the pre-commit configuration, suggesting updates to the latest versions to incorporate recent bug fixes and improvements.