From a002868c128450ac8e513a86ead8ff9c750100b2 Mon Sep 17 00:00:00 2001 From: Stephen Augustus Date: Fri, 24 Jan 2025 21:41:39 -0500 Subject: [PATCH] cmd/multi-scorecard: Update installation command and tool history Signed-off-by: Stephen Augustus --- cmd/multi-scorecard/README.md | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/cmd/multi-scorecard/README.md b/cmd/multi-scorecard/README.md index 155d6140252..5b16498f6e3 100644 --- a/cmd/multi-scorecard/README.md +++ b/cmd/multi-scorecard/README.md @@ -1,29 +1,30 @@ -# Multi Scorecard +# `multi-scorecard` -This program runs [OpenSSF Scorecard](https://github.com/ossf/scorecard) over -many repositories using a [GitHub -App](https://docs.github.com/en/apps/creating-github-apps/about-creating-github-apps/about-creating-github-apps) -credential. GitHub is queried to determine the orgs and repos the app is -installed on to determine which repos to run Scorecard over. Results are -printed to stdout in a JSON array. +This program runs OpenSSF Scorecard over many repositories using a [GitHub App](https://docs.github.com/en/apps/creating-github-apps/about-creating-github-apps/about-creating-github-apps) credential. +GitHub is queried to determine the orgs and repos the app is installed on to determine which repos to run Scorecard over. + +Results are printed to stdout in a JSON array. + +*`multi-scorecard` was originally featured as part of [Jeff Mendoza](https://github.com/jeffmendoza) and [Stephen Augustus](https://github.com/justaugustus)' SOSS Fusion talk, "Scorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories".* + +- [Session page with slides](https://sched.co/1hcPq) +- [Session recording](https://youtu.be/-XZqbO3hGcw?si=eGicz0sjgiIRhol4) +- [Previous source repository](https://github.com/jeffmendoza/multi-scorecard) ## Usage -A [GitHub -App](https://docs.github.com/en/apps/creating-github-apps/about-creating-github-apps/about-creating-github-apps) -must be created and installed on the repositories you wish to scan. +A [GitHub App](https://docs.github.com/en/apps/creating-github-apps/about-creating-github-apps/about-creating-github-apps) must be created and installed on the repositories you wish to scan. To install: -``` -go get github.com/jeffmendoza/multi-scorecard@latest +```console +go get github.com/ossf/scorecard/cmd/multi-scorecard@multi-scorecard ``` To run: -``` +```console multi-scorecard -appid 1234 -keyfile my-app.private-key.pem > results.json ``` -Where `1234` is the App ID of the app, and `my-app.private-key.pem` is the -private key file of the app. +Where `1234` is the App ID of the app, and `my-app.private-key.pem` is the private key file of the app.