Add OpenSSF scorecard workflow

Ensure following best open source security practices by monitoring OpenSSF score of the project. Signed-off-by: Boris Glimcher <[email protected]>
opiproject · Jul 6, 2023 · a507d33 · a507d33
1 parent ab0ed8b
commit a507d33
Showing 1 changed file with 22 additions and 0 deletions.
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -0,0 +1,22 @@
+name: OpenSSF
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+
+jobs:
+  call:
+    permissions:
+      # Keep in sync with opi-smbios-bridge, no direct way to inherit permissions
+      contents: read
+      security-events: write
+      id-token: write
+      actions: read
+    uses: opiproject/opi-smbios-bridge/.github/workflows/scorecard.yml@main
+    secrets: inherit