ci: add security audtit and ossf scorecard (#1359)

* ci: add ossf scorecard and security report

* chore: edit cronjob

Author: lhoupert

.github/workflows/scorecard.yml

@@ -0,0 +1,52 @@
+# https://github.com/ossf/scorecard-action
+name: Scorecard analysis
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+  schedule:
+    # Weekly on Saturdays at 01:35 UTC (offset from other scheduled jobs)
+    - cron: "30 7 * * 1"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  actions: read # Required by Scorecard to evaluate workflow security posture
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Upload Scorecard SARIF to GitHub Code Scanning
+      id-token: write # GitHub OIDC token used when publish_results is true
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
+        with:
+          sarif_file: results.sarif

README.md

@@ -22,6 +22,9 @@
   <a href="https://hub.docker.com/r/developmentseed/titiler" target="_blank">
       <img src="https://img.shields.io/docker/v/developmentseed/titiler?color=%2334D058&label=docker%20hub" alt="Docker">
   </a>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/developmentseed/titiler" target="_blank">
+      <img src="https://api.scorecard.dev/projects/github.com/developmentseed/titiler/badge" alt="OpenSSF Scorecard">
+  </a>
 </p>
 
 ---