Repository navigation
task: Add OpenSSF Scorecard to relevant repositories #227
Description
Overview
OpenSSF Scorecard is an automated tool from the Open Source Security Foundation that assesses repositories against a set of security best practice checks and assigns each a score of 0–10. Unlike Renovate and Trivy which find specific vulnerabilities, Scorecard evaluates the project's security posture — whether the repository is configured in a way that prevents vulnerabilities from being introduced in the first place.
See the RFC 007 (platform-mesh/architecture#26) for more details.
Implementation Details
Add the OpenSSF Scorecard GitHub Action to user-facing repositories (core services & operators, shared libraries, and shipped artifacts). Enable publish_results: true and add the Scorecard badge to the repo's README.
For more information, see #227 (comment)
Reusable workflow (defined once in platform-mesh/.github/.github/workflows/job-scorecard.yml):
name: OpenSSF Scorecard
on:
workflow_call:
permissions: read-all
jobs:
analysis:
runs-on: ubuntu-latest
permissions:
security-events: write
id-token: write
steps:
- uses: actions/checkout@SHA_PLACEHOLDER
with:
persist-credentials: false
- name: Run OpenSSF Scorecard
uses: ossf/scorecard-action@SHA_PLACEHOLDER
with:
results_file: scorecard-results.sarif
results_format: sarif
publish_results: true
- name: Upload Scorecard results to Security tab
uses: github/codeql-action/upload-sarif@SHA_PLACEHOLDER
with:
sarif_file: scorecard-results.sarifCaller workflow (in each repo, e.g. .github/workflows/scorecard.yml):
name: Scorecard
on:
schedule:
- cron: '0 6 * * *' # Daily at 6 AM
push:
branches:
- main
- 'release-*' # Supported release branches (current-N, to be defined in a dedicated proposal)
jobs:
scorecard:
uses: platform-mesh/.github/.github/workflows/job-scorecard.yml@mainAfter the first run, a badge can be added to each repository's README:
[](https://scorecard.dev/viewer/?uri=github.com/platform-mesh/REPO_NAME)Completion Checklist
- Code implemented and tested
- Documentation updated
- Changes reviewed
Activity
Perseus985 commentedon Apr 16, 2026
The issue says "all repositories," but in my view that's too broad. Scorecard evaluates the security posture of repos others rely on. Applying it to docs/samples/POCs would:
I'd propose starting with core services & operators, shared libraries, and shipped artifacts:
Scoped repos
Out of Scope
No production code / meta:
Samples / examples / templates (meant to be copied, not depended on):
POCs (non-production, scored out of context):
Debatable
Happy to include additional repos if someone says otherwise :)
EDIT
Added provider-quickstart, ocm, and platform-mesh.github.io to the Scorecard, because after some thought, it would be good to have those scores and improvements included. Adopters will rely on the provider quickstart to build their own solutions, ocm (which provides the PM OCM package), and the website with its documentation, all of which need to be reliable.
docs: add OpenSSF Scorecard public documentation
docs: add OpenSSF Scorecard public documentation
docs: add OpenSSF Scorecard reference
Add OpenSSF scorecard documentation (#122)
mirzakopic commentedon May 4, 2026
@xmudrii can you please scope it down to what @Perseus985 mentioend?
[-]task: Add OpenSSF Scorecard to all repositories[/-][+]task: Add OpenSSF Scorecard to relevant repositories[/+]xmudrii commentedon May 4, 2026
@mirzakopic @Perseus985 Thanks for pointing this out, very good point! I scoped down the ticket.
That said, according to #227 (comment), we should be all set. @mirzakopic created follow up issues to eventually fix problems discovered by Scorecard. I'll go ahead and close this ticket.
mirzakopic commentedon May 4, 2026
Follow up issues are in #278