code.scorecardOpenSSF Scorecard
Runs OpenSSF Scorecard against the GitHub repository named by the workspace's origin remote and reports checks that scored 0-9, with severity from each check's documented risk scaled by score. Needs GITHUB_AUTH_TOKEN or GITHUB_TOKEN; it calls the GitHub API about the remote repository, not the local files.
- Engine
- Wrapped scanner
- Wraps
scorecard- Targets
- Codebase
- Areas
- Supply chain
- Runs
- By default, when the target applies
- Network
- Contacts services beyond the target
Run only this auditor
bunx openaudit . --only code.scorecardWraps scorecard. When it isn't installed, the auditor is skipped with an install hint and the rest of the audit runs.