Added the OpenSSF Scorecard Badge #10338
Conversation
Signed-off-by: harshitasao <harshitasao@gmail.com>
|
Hi @harshitasao. Thanks for your PR. I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
| @@ -6,6 +6,7 @@ | |||
| [](https://github.com/containerd/containerd/actions?query=workflow%3ANightly) | |||
| [](https://goreportcard.com/report/github.com/containerd/containerd/v2) | |||
| [](https://bestpractices.coreinfrastructure.org/projects/1271) | |||
| [](https://api.securityscorecards.dev/projects/github.com/containerd/containerd) | |||
There was a problem hiding this comment.
Clicking the link takes me to the api. subdomain, which is not human-readable; should that be a different subdomain? https://api.securityscorecards.dev/projects/github.com/containerd/containerd
|
We didn't have this added previously because the scoring system was buggy. It seems much of that is fixed but still see a couple errors in the score based on https://scorecard.dev/viewer/?uri=github.com/containerd/containerd. We have already followed the guidance for "Token-Permissions" yet the score is 0 and does not match the documentation remediation steps. How is it supposed to check branch protection, we have that in place but not something that would be accessible to view. |
This PR adds OpenSSF Scorecard Badge in the README file.
The project already has the Scorecard GitHub Action running, so adding the scorecard badge would be quite handy. So that the results can be shown as a badge in the repository's README. This badge serves as a quick indicator of the project's security posture, helping users and contributors evaluate the project's security practices quickly.