OpenSSF Scorecard

[sheldonhull]

Overview

docker run -e GITHUB_AUTH_TOKEN=$GITHUB_TOKEN gcr.io/openssf/scorecard:stable --repo=github.com/aquaproj/aqua

Can we get this running on the aqua projects? opensssf scorecard and scorecard site I include those on the renovate PR's, so nice to see it showing up. Aqua repo didn't do too bad either!

Why is the proposal needed?

Nice to have :-)

Note

Take a peek at github action here: https://github.com/marketplace/actions/ossf-scorecard-action.
If you create a github-actions repo I'd contribute the reusable PR there.

For example: https://github.com/sheldonhull/github-workflows/ and then i can submit the reusable workflow to your different repos.

NOTE: This isn't an important/urgent request, just something that seems nice to have and I'm willing to contribute so it's minimal effort if you like the idea and have a github resuable workflow to submit the change to.

[suzuki-shunsuke]

Thank you for your suggestion.
I'm not familiar with OpenSSF Scorecard, but it looks nice.
I'll take a look.

[suzuki-shunsuke]

I tried OpenSSF Scorecard with another repository. https://github.com/suzuki-shunsuke/mkghtag

https://github.com/suzuki-shunsuke/mkghtag/security/code-scanning

• Add a workflow ci: try OpenSSF Scorecard suzuki-shunsuke/mkghtag#321
• Add a badge docs: add a badge of OpenSSF Scorecard suzuki-shunsuke/mkghtag#323

https://securityscorecards.dev/viewer/?uri=github.com/suzuki-shunsuke/mkghtag

[suzuki-shunsuke]

I added a workflow.

https://securityscorecards.dev/viewer/?uri=github.com/aquaproj/aqua

• ci: use OpenSSF Scorecard #2933
  • https://github.com/aquaproj/aqua/blob/main/.github/workflows/push-main.yaml
  • https://github.com/suzuki-shunsuke/ossf-scorecard-workflow