ci: add the OpenSSF Scorecard workflow - #16
Merged
Merged
Conversation
Every other check here tests the code. None of them look at how the code gets published — whether actions are pinned to SHAs, whether the default branch is protected, whether workflow tokens are scoped down, whether a vulnerability can be reported privately. Scorecard reads exactly that and scores it. It is worth having because most of those are *settings*, not code, so nothing in the existing lanes notices when one regresses. Results upload to the code scanning dashboard next to CodeQL, so a slip in the release pipeline surfaces in the same place as one in the source. Runs weekly, on pushes to `main`, and on demand. `permissions: read-all` at the top with the three writes it actually needs declared on the job. Both actions are pinned to commit SHAs, which is one of the things it grades. It reports and changes nothing. Free on public repositories. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every other check in this repository tests the code. None of them look at how
the code gets published — whether actions are pinned to commit SHAs, whether
the default branch is protected, whether workflow tokens are scoped down,
whether a vulnerability can be reported privately.
Most of those are settings, not code, so nothing in the existing lanes
notices when one regresses. That is the gap this fills.
What it does
main, and on demandrelease pipeline surfaces in the same place as one in the source
permissions: read-allat the top, with the three writes it actually needsdeclared on the job
publish_results: truemakes the score readable by anyone deciding whether todepend on this, which is the point of measuring it.
It reports and changes nothing. Free on public repositories.
Provenance
Copied from
health-data-dotnet, which has been running it. Both pinned SHAswere checked to resolve, and
actions/checkoutmatches the SHA already usedelsewhere in this repository.
🤖 Generated with Claude Code