Skip to content

ci: add OpenSSF Scorecard workflow - #422

Closed
Ady0333 wants to merge 1 commit into
kubescape:mainfrom
Ady0333:ci/scorecard-workflow
Closed

Ady0333 wants to merge 1 commit into
kubescape:mainfrom
Ady0333:ci/scorecard-workflow

Conversation

@Ady0333

@Ady0333 Ady0333 commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

Closes #415

This adds .github/workflows/scorecard.yml so we get OpenSSF Scorecard results on every push to main and once a week.

What it does:

  • Top level is permissions: read-all, and the job only gets what it needs:
    permissions:
      security-events: write
      id-token: write
  • All actions are pinned by SHA, same as the rest of our workflows.
  • It uploads the SARIF file to Code Scanning with github/codeql-action/upload-sarif.

🤖 Generated with Claude Code

Closes kubescape#415

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Ady0333 <adityashinde1525@gmail.com>
@coderabbitai

coderabbitai Bot commented Oct 5, 2026

Copy link
Copy Markdown

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: c4232ed2-f373-45ac-b44e-79ffe09b852a
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@Ady0333 Ady0333 closed this Oct 5, 2026
@Ady0333
Ady0333 deleted the ci/scorecard-workflow branch October 5, 2026 12:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add automated OpenSSF Scorecard workflow

1 participant