Files

Poker Design Developer 5dbcebf7a2 Fix frontend blank page issues

- Fix router import path in main.js
- Handle Django REST Framework pagination format in API calls
- Add getTemplates function to project API
- Restart frontend development server

2026-05-31 18:40:56 +08:00

3.0 KiB

Raw Blame History

OpenSSF Scorecard Remediation Plan

Last updated: 2026-04-18

Current public Scorecard snapshot for github.com/fabricjs/fabric.js:

Aggregate score: 6.1 / 10
Report date: 2026-04-18T07:39:30Z
Reported commit: f80aa89a0614f1936952d53557ed46abd94f8d6f

Checks below 10:

Dangerous-Workflow: 0
Token-Permissions: 0
Fuzzing: 0
CII-Best-Practices: 0
Code-Review: 5
Pinned-Dependencies: 7
Binary-Artifacts: 8
CI-Tests: 8
SAST: 9
Packaging: -1
Signed-Releases: -1
Branch-Protection: -1

Priority Order

Harden GitHub Actions workflows.
Remove or replace checked-in binaries.
Make release and packaging workflows easier for Scorecard to detect.
Tighten GitHub branch protection and required-check settings.
Add fuzzing and signed release provenance.
Complete OpenSSF Best Practices badge requirements.

Action Plan

1. CI hardening

Replace the Sonar workflow's explicit head_sha / head_branch checkouts.
Keep fork PR support by using an untrusted test workflow followed by a privileged analysis workflow that does not build or install from the fork in the privileged context.
Avoid explicit head_sha / head_branch checkouts in privileged follow-up workflows when a safer ref or merge ref is available.
Reduce workflow token permissions to read-only by default and grant writes only where they are required.
Add missing top-level permissions declarations so Scorecard can see least-privilege defaults.
Pin any remaining third-party actions by full commit SHA.

2. Binary artifacts

Remove lib/google_closure_compiler.jar if it is no longer used.
Remove lib/yuicompressor-2.4.6.jar if it is no longer used.
If either file is still needed, fetch it during CI or replace it with maintained npm tooling.

3. Packaging and release signals

Simplify the npm release workflow so Scorecard can detect an official packaging path.
Prefer npm ci over npm install in publish workflows.
Move opaque publish logic out of publish.js where possible and keep the publish command explicit in workflow YAML.
Evaluate npm publish --provenance for stronger release provenance.

4. Repository settings

Enable or verify branch protection rules for master, 5.x, and 6.x.
Require pull requests, approvals, stale-review dismissal, and up-to-date checks before merge.
Make CI and CodeQL required checks for protected branches.
Configure a fine-grained SCORECARD_TOKEN so the Scorecard action can read branch protection state.

5. Longer-horizon security work

Add focused fuzz targets for SVG parsing, path parsing, JSON deserialization, and text/layout edge cases.
Publish signed release artifacts or attestations alongside GitHub Releases.
Apply for the OpenSSF Best Practices badge after workflow and policy gaps are closed.

First implementation pass

This branch starts with the CI hardening items:

Sonar workflow redesign
obvious permission tightening in CI workflows
documentation of the remaining Scorecard work

3.0 KiB Raw Blame History