ci: adopt OSSF Scorecard for automated security-posture scoring (#190) - #256
Merged
Conversation
New: `.github/workflows/scorecard.yml` - ossf/scorecard-action@v2.4.2 on weekly schedule (Mon 06:00 UTC) + push to main + workflow_dispatch for on-demand audits. - Job permissions floor: security-events:write (SARIF upload), id-token:write (OIDC-based publish to OpenSSF public database), contents:read, actions:read. Top-level permissions: read-all. - publish_results gated to non-PR events so in-flight PR scores don't pollute the badge / public API. - SARIF uploaded to Code Scanning (Security tab) alongside CodeQL + DevSkim. - Also archived as workflow artifact (30-day retention) for post-hoc analysis. README.md: added the scorecard.dev badge in the badge row. docs/SECURITY-SCORECARD.md: baseline + policy doc. - Score floor 7.5 documented as a SOFT gate (reviewer attention, CHANGELOG note on regression), not a hard CI block. Hard-gating would produce persistent noise from strict rules + transient false positives. - Sub-6.0 treated as an incident. - Baseline table stubbed for population after first successful run. - Known-acceptable findings table stubbed. - Cross-references the other four scanners (CodeQL, DevSkim, Gitleaks, InspectCode) so future contributors know Scorecard is distinct — it scans repo CONFIGURATION, not code. Closes #190
This was referenced Jul 15, 2026
This was referenced Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adopts OSSF Scorecard per #190. Complements CodeQL / DevSkim / Gitleaks (which scan the code) by scoring the repo configuration + release-engineering practices against ~20 best practices (branch protection, pinned actions, signed commits, dangerous-workflow patterns, vulnerability response time, …).
Changes
.github/workflows/scorecard.yml—ossf/scorecard-action@v2.4.2. Weekly Mon 06:00 UTC + push to main +workflow_dispatch. Results upload to Code Scanning (SARIF) and to the OpenSSF public database (only on non-PR runs, so in-flight PR scores don't pollute the badge). Job permissions:security-events:write,id-token:write(OIDC-based public publish),contents:read,actions:read. Top-levelpermissions: read-all.README.md— addedscorecard.devbadge in the existing badge row (between Release and License).docs/SECURITY-SCORECARD.md— baseline + policy doc. Score-floor is 7.5 as a soft gate (reviewer attention + CHANGELOG note on regression, not a hard CI block — Scorecard is strict enough that transient dependency drift can drop the score temporarily while a fix is in flight). Below 6.0 is an incident. Baseline table + known-acceptable-findings table are stubbed for population after the first successful main-push run.Protected-file note
Adds
.github/workflows/scorecard.yml— a new workflow file.Detect .NET Projectswill fail as expected → admin-bypass required at merge.After merge
docs/SECURITY-SCORECARD.md(score, failed/passing checks).Test plan
publish_resultsgated to non-PR eventsCloses #190