diff --git a/README.md b/README.md index f6b63d288..585f61e53 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,4 @@ -

- -

-Secure your GitHub repo with ease through automated security fixes -

+

@@ -14,42 +10,22 @@ Secure your GitHub repo with ease through automated security fixes

- Secure repo screenshot +Automatically apply security best practices in your GitHub repository +

+ +

+ Secure repo screenshot

+ Catalog of Fixes + Quickstart - - Functionality Contributing

-## Quickstart - -### Hosted Instance: [app.stepsecurity.io/securerepo](https://app.stepsecurity.io/securerepo) - -To secure your GitHub repo using a pull request: - -- Go to https://app.stepsecurity.io/securerepo and enter your public GitHub repository -- Log in using your GitHub Account (no need to install any App or grant `write` access) -- View recommendations and click `Create pull request.` Here is an example pull request: https://github.com/electron/electron/pull/36343. - -### Integration with OpenSSF Scorecard - -- Add [OpenSSF Scorecards](https://github.com/ossf/scorecard-action) starter workflow -- View the Scorecard results in GitHub Code Scanning UI -- Follow the remediation tip that points to https://app.stepsecurity.io - -

- Secure repo Scorecard integration screenshot -

- -### Self Hosted - -To create an instance of Secure Workflows, deploy _cloudformation/ecr.yml_ and _cloudformation/resources.yml_ CloudFormation templates in your AWS account. You can take a look at _.github/workflows/release.yml_ for reference. - -## Functionality +## Catalog of Fixes 1. [Automatically set minimum GITHUB_TOKEN permissions](#1-automatically-set-minimum-github_token-permissions) 2. [Add Harden-Runner GitHub Action to each job](#2-add-harden-runner-github-action-to-each-job) @@ -227,7 +203,7 @@ Before the fix, you do not have a OpenSSF Scorecard workflow. After the fix, a `scorecards.yml` GitHub Actions workflow gets added to your project. -**Pull request example**: https://github.com/mcornick/clilol/pull/14 +**Pull request example**: https://github.com/microsoft/CLRInstrumentationEngine/pull/527 This pull request adds OpenSSF Scorecard to the list of workflows. @@ -235,6 +211,30 @@ This pull request adds OpenSSF Scorecard to the list of workflows. Secure-Repo has a [workflow-templates](https://github.com/step-security/secure-repo/tree/main/workflow-templates) folder. This folder has the default Scorecard workflow, which gets added as part of the pull request. +## Quickstart + +### Hosted Instance: [app.stepsecurity.io/securerepo](https://app.stepsecurity.io/securerepo) + +To secure your GitHub repo using a pull request: + +- Go to https://app.stepsecurity.io/securerepo and enter your public GitHub repository +- Log in using your GitHub Account (no need to install any App or grant `write` access) +- View recommendations and click `Create pull request.` Here is an example pull request: https://github.com/electron/electron/pull/36343. + +### Integration with OpenSSF Scorecard + +- Add [OpenSSF Scorecards](https://github.com/ossf/scorecard-action) starter workflow +- View the Scorecard results in GitHub Code Scanning UI +- Follow the remediation tip that points to https://app.stepsecurity.io + +

+ Secure repo Scorecard integration screenshot +

+ +### Self Hosted + +To create an instance of Secure Workflows, deploy _cloudformation/ecr.yml_ and _cloudformation/resources.yml_ CloudFormation templates in your AWS account. You can take a look at _.github/workflows/release.yml_ for reference. + ## Contributing Contributions are welcome! diff --git a/images/secure-repo-1.gif b/images/secure-repo-1.gif new file mode 100644 index 000000000..a116ea9ac Binary files /dev/null and b/images/secure-repo-1.gif differ diff --git a/images/secure-repo.gif b/images/secure-repo.gif deleted file mode 100644 index 972b878aa..000000000 Binary files a/images/secure-repo.gif and /dev/null differ