Integration of a Scorecard Template into CI/CD pipeline

Louise Grossetrequested to merge
lg/scorecard-template into main

This MR adds a CI template to run OpenSSF Scorecard on GitLab repositories in order to evaluate them against common open-source security best practices.

Related to #46

Feature

Adds templates/scorecard.yml with a single scorecard job that:

  • scans the repository against a configurable set of checks
  • archives the results as a JSON artifact
  • fails the job (non-blocking) if the global score is below SCORECARD_MIN_SCORE (default 5)

The job only runs on scheduled or manual web pipelines.

Token/Permissions

The job uses two GitLab CI/CD variables with the following permissions:

  • SCORECARD_TOKEN :
    • read_repository
    • read_api
  • SCORECARD_MAINTAINER_TOKEN :
    • Maintainer role
    • read_repository
    • read_api
Edited by Louise Grosset

Merge request reports