mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-13 22:32:04 +00:00
Marc-André Bombeck
b713ed8c34
Most of what Scorecard looks for this repository already does: Actions pinned by commit SHA, a security policy with a private reporting path, Dependabot with auto-merge, keyless signing on the release image, a branch-protected trunk. The value is not the score, it is that the checks keep running after the person who set them up has moved on, and that anyone evaluating the project can read the result without being given CI access. publish_results is on, which is what makes the score citable. It reads repository metadata and the workflow files; nothing about the code or its contents goes anywhere. The token is an OIDC exchange, the same mechanism the release workflow already uses to sign the image. No badge in the README yet. The public API has no entry for this repository until the first run publishes one, and the badge URL currently renders 'invalid repo path'. It goes in once there is a score behind it.