ci: Add OpenSSF Scorecard Workflow

.github/workflows/code-checks.yml

@@ -11,13 +11,13 @@
 permissions:
   contents: read
   packages: read
-  statuses: write
-  security-events: write
 
 jobs:
   check-code-quality:
     name: Check Code Quality
     runs-on: ubuntu-latest
+    permissions:
+      statuses: write
     steps:
       - name: Checkout
         uses: actions/[email protected]
@@ -46,6 +46,8 @@
   check-python-code-format-and-quality:
     name: Check Python Code Format and Quality
     runs-on: ubuntu-latest
+    permissions:
+      statuses: write
     steps:
       - name: Checkout
         uses: actions/[email protected]
@@ -71,6 +73,9 @@
   upload-ruff-analysis-results:
     name: Upload Ruff Analysis Results
     runs-on: ubuntu-latest
+    permissions:
+      statuses: write
+      security-events: write
     steps:
       - name: Checkout
         uses: actions/[email protected]
@@ -96,6 +101,8 @@
   run-codeql-analysis:
     name: CodeQL Analysis
     runs-on: ubuntu-latest
+    permissions:
+      statuses: write
     steps:
       - name: Checkout repository
         uses: actions/[email protected]
@@ -110,6 +117,8 @@
   check-markdown-links:
     name: Check Markdown links
     runs-on: ubuntu-latest
+    permissions:
+      statuses: write
     steps:
       - name: Checkout Repository
         uses: actions/[email protected]
@@ -128,6 +137,8 @@
   check-justfile-format:
     name: Check Justfile Format
     runs-on: ubuntu-latest
+    permissions:
+      statuses: write
     steps:
       - name: Checkout Repository
         uses: actions/[email protected]
@@ -143,6 +154,8 @@
   docker-build:
     name: Build Docker Image
     runs-on: ubuntu-latest
+    permissions:
+      statuses: write
     steps:
       - name: Checkout
         uses: actions/[email protected]
@@ -158,6 +171,35 @@
       - name: Build Docker Image
         run: just docker-build
 
+  run-scorecard-analysis:
+    name: Scorecard Analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
+      issues: read
+      pull-requests: read
+      checks: read
+    steps:
+      - name: "Checkout code"
+        uses: actions/[email protected]
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/[email protected]
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/[email protected]
+        with:
+          sarif_file: results.sarif
+
   run-code-limit:
     name: Code Limit Analysis
     runs-on: ubuntu-latest