Improve OpenSSF Scorecard report - Githubissues

hyperledger / fabric-private-chaincode

FPC enables Confidential Chaincode Execution for Hyperledger Fabric using Intel SGX.

Apache License 2.0

160 stars 91 forks source link

Improve OpenSSF Scorecard report #763

Open mbrandenburger opened 2 months ago

mbrandenburger commented 2 months ago

Currently, the FPC repo has a scorecard of 4.3 (see https://scorecard.dev/viewer/?uri=github.com/hyperledger/fabric-private-chaincode)

This issue is about improving our scorecard value by applying best practices as suggested by OpenSSF

TODOS:

[x] Dangerous-Workflows
[x] Token-Permissions #764
[ ] Vulnerabilities #759
[ ] Maintained
[ ] Code-Review
[ ] Binary-Artifacts
[ ] Fuzzing (TBD)
[ ] SAST
[ ] Pinned-Dependencies
[x] Security-Policy
[ ] CII-Best-Practices
[x] License
[ ] Branch-Protection
[ ] Packaging
[ ] Signed-Releases