ci: add OpenSSF Scorecard workflow

[wizzomafizzo]

Summary

• Add weekly OpenSSF Scorecard analysis
• Results published to scorecard.dev and uploaded to Security tab
• Runs on push to main and weekly schedule

Summary by CodeRabbit

• Chores
  • Added automated security scanning with OpenSSF Scorecard; runs on pushes to main and weekly.
  • Publishes scan results to code scanning and saves a downloadable report artifact with a 5-day retention.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a92cdf81-59a2-4894-be1b-65505b80fe09

📥 Commits

Reviewing files that changed from the base of the PR and between 5c22528 and 9eed2b7.

📒 Files selected for processing (1)

• .github/workflows/scorecard.yml

✅ Files skipped from review due to trivial changes (1)

• .github/workflows/scorecard.yml

---

📝 Walkthrough

Walkthrough

A new GitHub Actions workflow (.github/workflows/scorecard.yml) is added to run OpenSSF Scorecard on pushes to main and weekly. It produces SARIF output, uploads results to GitHub code scanning, and saves the SARIF as a workflow artifact with a 5-day retention.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow Configuration .github/workflows/scorecard.yml	Adds a workflow that triggers on push to main and a weekly schedule; sets job permissions, checks out the repo, runs ossf/scorecard-action to produce results.sarif (published), uploads SARIF to GitHub code scanning, and archives results.sarif as an artifact with 5-day retention.

Sequence Diagram(s)

sequenceDiagram
    participant GitHub as GitHub Actions
    participant Repo as Repository
    participant Scorecard as ossf/scorecard-action
    participant CodeScan as GitHub Code Scanning API
    participant Artifact as Actions Artifact Storage

    GitHub->>Repo: trigger on push/main or schedule
    GitHub->>Repo: checkout repository
    GitHub->>Scorecard: run scorecard-action -> generate results.sarif
    Scorecard-->>GitHub: provide SARIF (results.sarif)
    GitHub->>CodeScan: upload SARIF via upload-sarif
    GitHub->>Artifact: upload results.sarif as artifact (5-day retention)

Loading

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐇 I hopped in to scan each line,

SARIF in paw, results align,
Weekly and on main I sweep,
Guarding code while others sleep,
A tiny rabbit, watchful, fine 🥕🔍

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'ci: add OpenSSF Scorecard workflow' directly and clearly describes the main change: adding a GitHub Actions workflow for OpenSSF Scorecard analysis.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/scorecard

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/scorecard.yml:
- Around line 13-15: The job-level permissions block currently lists only
security-events and id-token but omits repository read access, causing
actions/checkout to fail; update the permissions block (the permissions: section
shown in the diff) to include contents: read alongside security-events: write
and id-token: write so actions/checkout can access repository files (i.e., add a
contents: read entry in the same permissions mapping).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: db9ade25-4fd1-41d8-acd0-329dc8db5673

📥 Commits

Reviewing files that changed from the base of the PR and between cda47fc and 5c22528.

📒 Files selected for processing (1)

• .github/workflows/scorecard.yml