Add OSSF Scorecard GH Action and badge to README
CyrilBaah opened this issue · 2 comments
-
Improvement Area:
Add OpenSSF Scorecard GitHub Action to automatically evaluate the security and best practices of the repository. -
Reasons:
Integrating the OSSF Scorecard will help identify vulnerabilities, improve the code's security posture, and increase transparency for contributors and users. -
Benefits
to help open source maintainers improve their security best practices and to help open source consumers judge whether their dependencies are safe.
We don't necessarily need to run it ourselves in GitHub Actions, because it's already being run by scorecard.dev. Here's crystal's scorecard: https://scorecard.dev/viewer/?uri=github.com/crystal-lang/crystal. However, running it ourselves would allow us to remove specific checks, such as fuzzing (since there is no fuzzing tool for crystal).