feat(CI-CD): add OpenSSF Scorecard workflow - #61
Merged
Merged
Conversation
✅ PR Validation Passed
📋 Pipeline Status
🤖 Generated by @helpers4 CI • 2026-08-10 |
…script Copied the working pattern from helpers4/typescript (already registered and scored — verified directly against the public API, contradicting ROADMAP.md's old note that nothing was registered anywhere yet: that was true at some point, isn't anymore). Same weekly schedule, same publish_results: true, same badge markup in README.md. Depends on a SCORECARD_TOKEN secret existing for this repo — couldn't verify via API whether it's already available at the org level or only configured on typescript specifically (repo/org secrets listing needs admin-level API access this session's token doesn't have). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
baxyz
force-pushed
the
openssf-scorecard
branch
from
August 10, 2026 22:52
375a7e7 to
88a6b00
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/scorecard.yml, copied from the already-workinghelpers4/typescriptsetup (verified live: typescript is actually registered on the public API with a real score, contradicting ROADMAP.md's stale "nothing registered" note).Open question
Needs a
SCORECARD_TOKENsecret available to this repo. I couldn't verify via API whether that's already an org-level secret or configured only ontypescript(secrets listing needs admin API access this session doesn't have) — please check Settings → Secrets and variables → Actions before merging, at either thehelpers4org level or thedevcontainerrepo level.Test plan
github.com/helpers4/devcontainershows up at https://scorecard.dev🤖 Generated with Claude Code