Shubham PampattiwarandGitHub 15458caf4a Add OpenSSF Scorecard workflow and README badge (#10467) ...

Velero has no published OpenSSF Scorecard results, so the Scorecard
badge does not resolve and CLOMonitor flags the openssf_scorecard_badge
check as missing.

Add the ossf/scorecard-action workflow (SHA-pinned, least-privilege
permissions, publish_results enabled) running weekly and on push to
main. Once it runs post-merge, results publish to the OpenSSF API and
the README badge resolves. This also surfaces the project's security
posture (currently 6.2/10) to guide further hardening.

Part of the CNCF incubation readiness work (#10383).

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

2026-09-09 12:26:29 -07:00

..

auto_assign_prs.yml

Bump the github-actions group with 4 updates (#10239)

2026-08-12 16:30:29 +08:00

auto_label_prs.yml

Bump actions/labeler from 5 to 7

2026-07-25 19:12:46 +00:00

backport.yml

Support /backport 1.17 shorthand and auto-fix changelog filename in backport PRs (#10389)

2026-08-25 10:34:10 -04:00

e2e-test-kind.yaml

Bump helm/kind-action in the github-actions group (#10481)

2026-09-08 16:42:26 +08:00

get-go-version.yaml

Set least-privilege GITHUB_TOKEN permissions in workflows

2026-09-03 10:14:23 -07:00

nightly-trivy-scan.yml

Set least-privilege GITHUB_TOKEN permissions in workflows

2026-09-03 10:14:23 -07:00

pr-changelog-check.yml

Evaluate changelog exemption labels from live PR state (#10472)

2026-09-03 09:58:20 -07:00

pr-ci-check.yml

Set least-privilege GITHUB_TOKEN permissions in workflows

2026-09-03 10:14:23 -07:00

pr-codespell.yml

Set least-privilege GITHUB_TOKEN permissions in workflows

2026-09-03 10:14:23 -07:00

pr-containers.yml

Set least-privilege GITHUB_TOKEN permissions in workflows

2026-09-03 10:14:23 -07:00

pr-filepath-check.yml

Set least-privilege GITHUB_TOKEN permissions in workflows

2026-09-03 10:14:23 -07:00

pr-goreleaser.yml

Set least-privilege GITHUB_TOKEN permissions in workflows

2026-09-03 10:14:23 -07:00

pr-linter-check.yml

Set least-privilege GITHUB_TOKEN permissions in workflows

2026-09-03 10:14:23 -07:00

prow-action.yml

Bump the github-actions group with 4 updates (#10239)

2026-08-12 16:30:29 +08:00

push-builder.yml

Set least-privilege GITHUB_TOKEN permissions in workflows

2026-09-03 10:14:23 -07:00

push.yml

Bump actions/setup-go from 6 to 7 (#10202)

2026-08-10 16:01:13 -04:00

rebase.yml

Replace rebase action with GitHub CLI (#10093)

2026-07-30 12:24:51 -04:00

scorecard.yml

Add OpenSSF Scorecard workflow and README badge (#10467)

2026-09-09 12:26:29 -07:00

stale-issues.yml

Set least-privilege GITHUB_TOKEN permissions in workflows

2026-09-03 10:14:23 -07:00