OpenSSF Security Scorecard Audit and AI Remediation

id: openssf-scorecard-supply-chain-audit
namespace: company.team
description: |
  Perform automated supply chain security audits using OpenSSF Scorecard.
  Clones a repository, runs the OpenSSF Scorecard container scanner, parses security
  risk scores across supply chain checks, evaluates threshold breaches, and uses AI
  to generate remediation guidance posted to GitHub issues and Slack.

triggers:
  - id: on_security_audit_webhook
    type: io.kestra.plugin.core.trigger.Webhook
    description: Webhook trigger fired on push or scheduled CI/CD security audit runs.
    key: "{{ secret('OPENSSF_AUDIT_WEBHOOK_KEY') }}"

inputs:
  - id: repository
    type: STRING
    defaults: your-org/your-repo
    displayName: Repository
    description: GitHub repository to audit in owner/repo format.
  - id: branch
    type: STRING
    defaults: main
    displayName: Branch
    description: Git branch to audit.
  - id: min_score_threshold
    type: FLOAT
    defaults: 7.0
    displayName: Minimum Score Threshold
    description: Minimum required OpenSSF Scorecard score (out of 10.0) before
      triggering security alert workflows.

tasks:
  - id: workspace
    type: io.kestra.plugin.core.flow.WorkingDirectory
    description: Shared workspace for cloning the repository and generating OpenSSF
      scan reports.
    tasks:
      - id: clone_repository
        type: io.kestra.plugin.git.Clone
        description: Check out the target repository for scanning.
        url: "https://github.com/{{ inputs.repository }}.git"
        username: x-access-token
        password: "{{ secret('GITHUB_TOKEN') }}"
        branch: "{{ inputs.branch }}"

      - id: run_openssf_scorecard
        type: io.kestra.plugin.scripts.shell.Commands
        description: Run official OpenSSF Scorecard CLI container to evaluate supply
          chain security risks.
        taskRunner:
          type: io.kestra.plugin.scripts.runner.docker.Docker
        containerImage: gcr.io/openssf/scorecard:v4.13.0
        env:
          GITHUB_AUTH_TOKEN: "{{ secret('GITHUB_TOKEN') }}"
        commands:
          - scorecard --repo=github.com/{{ inputs.repository }} --format=json
            --output=scorecard-report.json || true

      - id: parse_scorecard_results
        type: io.kestra.plugin.scripts.python.Script
        description: Parse OpenSSF Scorecard JSON results, compute overall risk score,
          and list failing security checks.
        taskRunner:
          type: io.kestra.plugin.core.runner.Process
        script: |
          import json
          import os

          report_path = "scorecard-report.json"
          overall_score = 0.0
          failing_checks = []

          if os.path.exists(report_path) and os.path.getsize(report_path) > 0:
              with open(report_path) as f:
                  data = json.load(f)
                  overall_score = data.get("score", 0.0)
                  checks = data.get("checks", [])
                  for check in checks:
                      score = check.get("score", 0)
                      if score < 7 and score != -1:
                          failing_checks.append({
                              "name": check.get("name"),
                              "score": score,
                              "reason": check.get("reason", "No reason provided")
                          })

          print(f"Overall OpenSSF Scorecard Rating: {overall_score}/10.0")
          print(f"Failing Checks Count: {len(failing_checks)}")

          print("::" + json.dumps({"outputs": {
              "overall_score": overall_score,
              "failing_checks_count": len(failing_checks),
              "failing_checks_json": json.dumps(failing_checks),
              "threshold_breached": overall_score < {{ inputs.min_score_threshold }} or len(failing_checks) > 0
          }}) + "::")

  - id: check_security_threshold
    type: io.kestra.plugin.core.flow.If
    description: Flow control check to branch based on OpenSSF Scorecard threshold breach.
    condition: "{{ outputs.parse_scorecard_results.vars.threshold_breached }}"
    then:
      - id: generate_ai_remediation
        type: io.kestra.plugin.ai.agent.AIAgent
        description: Generate automated security remediation guidance using LLM grounded
          in OpenSSF best practices.
        provider:
          type: io.kestra.plugin.ai.provider.GoogleGemini
          apiKey: "{{ secret('GEMINI_API_KEY') }}"
          modelName: gemini-2.5-flash
        systemMessage: |
          You are an OpenSSF Supply Chain Security expert. Given the failing OpenSSF Scorecard checks,
          provide concise, actionable step-by-step remediation advice to improve repository security posture.
        prompt: |
          Repository: {{ inputs.repository }}
          Overall OpenSSF Score: {{ outputs.parse_scorecard_results.vars.overall_score }}/10.0
          Failing Checks:
          {{ outputs.parse_scorecard_results.vars.failing_checks_json }}

      - id: create_github_security_issue
        type: io.kestra.plugin.github.issues.Create
        description: Open a security issue on GitHub detailing OpenSSF Scorecard
          findings and AI remediation steps.
        jwtToken: "{{ secret('GITHUB_TOKEN') }}"
        repository: "{{ inputs.repository }}"
        title: "🛡️ OpenSSF Security Scorecard Audit Alert (Score: {{
          outputs.parse_scorecard_results.vars.overall_score }}/10)"
        body: |
          ## OpenSSF Supply Chain Security Audit Report

          **Overall Security Rating:** `{{ outputs.parse_scorecard_results.vars.overall_score }}/10.0`
          **Target Branch:** `{{ inputs.branch }}`

          ### Failing OpenSSF Security Checks
          `{{ outputs.parse_scorecard_results.vars.failing_checks_json }}`

          ### AI Remediation Plan
          {{ outputs.generate_ai_remediation.textOutput }}

          ---
          *Automated by Kestra execution `{{ execution.id }}`*
        labels:
          - security
          - openssf
          - supply-chain

      - id: notify_slack_security_channel
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: Alert security team channel on Slack regarding OpenSSF threshold
          breach.
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {
            "text": "⚠️ *OpenSSF Security Scorecard Alert*\nRepository: `{{ inputs.repository }}`\nScore: *{{ outputs.parse_scorecard_results.vars.overall_score }}/10.0* (Threshold: {{ inputs.min_score_threshold }})\nFailing Checks: {{ outputs.parse_scorecard_results.vars.failing_checks_count }}\nGitHub Issue opened with AI remediation plan."
          }

    else:
      - id: log_clean_audit
        type: io.kestra.plugin.core.log.Log
        message: "OpenSSF Security Audit PASSED for {{ inputs.repository }}. Score: {{
          outputs.parse_scorecard_results.vars.overall_score }}/10.0."