mirror of
https://github.com/vmware-tanzu/velero.git
synced 2026-09-13 11:34:54 +00:00
Shubham PampattiwarandGitHub
15458caf4a
Velero has no published OpenSSF Scorecard results, so the Scorecard badge does not resolve and CLOMonitor flags the openssf_scorecard_badge check as missing. Add the ossf/scorecard-action workflow (SHA-pinned, least-privilege permissions, publish_results enabled) running weekly and on push to main. Once it runs post-merge, results publish to the OpenSSF API and the README badge resolves. This also surfaces the project's security posture (currently 6.2/10) to guide further hardening. Part of the CNCF incubation readiness work (#10383). Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>