ci: adding ossf workflow and osff/codeql badges

.github/workflows/scorecard-analysis.yml

@@ -0,0 +1,56 @@
+name: Scorecard analysis workflow
+on:
+    push:
+        # Only the default branch is supported.
+        branches:
+            - main
+    schedule:
+        # Weekly on Saturdays.
+        - cron: '30 1 * * 6'
+
+permissions: read-all
+
+jobs:
+    analysis:
+        name: Scorecard analysis
+        runs-on: ubuntu-latest
+        permissions:
+            # Needed for Code scanning upload
+            security-events: write
+            # Needed for GitHub OIDC token if publish_results is true
+            id-token: write
+
+        steps:
+            - name: 'Checkout code'
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+              with:
+                  persist-credentials: false
+
+            - name: 'Run analysis'
+              uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
+              with:
+                  results_file: results.sarif
+                  results_format: sarif
+                  # Scorecard team runs a weekly scan of public GitHub repos,
+                  # see https://github.com/ossf/scorecard#public-data.
+                  # Setting `publish_results: true` helps us scale by leveraging your workflow to
+                  # extract the results instead of relying on our own infrastructure to run scans.
+                  # And it's free for you!
+                  publish_results: true
+
+            # Upload the results as artifacts (optional). Commenting out will disable
+            # uploads of run results in SARIF format to the repository Actions tab.
+            # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
+            - name: 'Upload artifact'
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              with:
+                  name: SARIF file
+                  path: results.sarif
+                  retention-days: 5
+
+            # Upload the results to GitHub's code scanning dashboard (optional).
+            # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+            - name: 'Upload to code-scanning'
+              uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
+              with:
+                  sarif_file: results.sarif

README.md

@@ -1,4 +1,10 @@
-# Sphinx theme based on Intel's Design System
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/intel/intel-sphinx-theme/badge)](https://scorecard.dev/viewer/?uri=github.com/intel/intel-sphinx-theme)
+[![CodeQL](https://github.com/intel/intel-sphinx-theme/workflows/CodeQL/badge.svg)](https://github.com/intel/intel-sphinx-theme/security/code-scanning)
+
+
+# Intel® Sphinx Theme
+
+Sphinx theme based on Intel's Design System
 
 ## Installation and usage