Improve openssf scorecard (currently 5.2)

[nitrocode]

https://openssf.org/projects/scorecard/

Please consider adding the openssf badge to the readme and improving the scores. By improving the score, the repo and everyone that uses the tool will be that much safer.

You can also use stepsecurity to create an automated pr to help increase the score.

https://app.stepsecurity.io/?repo=https://github.com/open-policy-agent/conftest

Thanks!

[jalseth]

Hi, thanks for raising this. I am open to the idea, but a quick skim of the report shows multiple findings that are either false, or misleading. For example:

• It gives a score of 0 for GITHUB_TOKEN permissions, despite the only the release workflow having any write permissions
• It gives a score of 0 for fuzzing, but fuzzing doesn't make sense for a glue-code project like conftest
• It lists conftest as vulnerable to many things it is not vulnerable to, such as GHSA-6fpp-rgj9-8rwc which is a Java vuln and conftest does not have or use any Java code
• It gives a score of 0 just for not having the OpenSSF scorecard in the project

With all of these inaccuracies, I don't want to add this to conftest which may deter people from using the project because they think there are glaring security issues, when there are not. If you want to contribute to some of the areas where the project is indeed lacking (like release signing) that would be welcome.