chore: add OpenSSF Scorecard for README.md#3696
Conversation
|
@fengshunli |
Signed-off-by: fsl <1171313930@qq.com>
|
|
The score of this check is very low and needs to be further optimized |
It might not be merged right currently. |
|
https://github.com/gogf/gf/security/code-scanning The security issues found here may need to be fixed |
It might not be merged right currently util the openssf score get improved. |
https://www.bestpractices.dev/en/projects?q=gf Complete the terms in the form and you can pass it |
Why is this needed:
The OpenSSF Scorecard improves open-source project's security by providing automated, transparent assessments of their security practices. It will help you identify vulnerabilities, adhere to best practices, and continuously enhance your security posture, increasing user trust and reducing the risk of security exploits.
I'll be the one to create the PR to add the scorecard GitHub action, and I will also work with you to remediate the identified vulnerabilities. I'll go through each scorecard check to see where the score has dropped and how it can be improved.
Integrate scorecard in CI, and display a Scorecard badge on the gogf repository
You also need to manually create a project, refer to https://bestpractices.coreinfrastructure.org/en/projects
Manually create an gogf organization to report results, please see https://sonarcloud.io/explore/projects?sort=-analysis_date