Automating dependency selection with open-source tools at scale
summary
Automates dependency selection by running OpenSSF Scorecard as a CLI, GitHub Action or CI job to produce 0–10 scores (scores >7 are “good”), and by using Scorecard Monitor to scan entire orgs, version results by commit, and auto-create issues or PRs while warning that PRs can break builds so tests must run. Adds behavioral analysis via package analysis (npm PyPI Ruby Gems) to catch network calls and file accesses, a mirrored repo service for curated installs, and a security baseline of 40 requirements across three maturity levels; reported savings reach about 15% on dependency handling.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 8:47Why dependency selection matters
- 17:25OpenSSF Scorecard for project health
- 25:31Beyond security: Healthy open source
- 33:40Scaling dependency selection
- 43:35Education and business value
- 51:07Key takeaways
- 54:42Q&A
related talks
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
27mHow Do You Trust Your Open Source Software?
25mHow do you trust your open source software?
16mFortify Your Code: Secure Your Supply Chain with Scorecard
31mAssessing Open Source Software Projects in the Software Supply Chain
42mProtect Yourself from Malicious Dependencies with One Cool Trick