setup ossf scorecard reporting for NodeSecure

[fraxken]

Hello 👋

I think it could be cool to configure and use @UlisesGascon OpenSSF Scorecard Monitor project to generate a markdown file with all scorecard scores from our org repositories.

See the following ongoing PR for an example: nodejs/security-wg#886

If anyone would like to contribute and help, please do not hesitate

[UlisesGascon]

I will love to do it! 🎉

[fraxken]

@UlisesGascon If you want to do it don't hesitate, I was waiting to see if some contributors would take the subject (but no one manifest interest).

[fraxken]

@UlisesGascon doesn't seem to work, any idea why ? (I runned the workflow myself).

[UlisesGascon]

Let me check, this is the expected output if there are no changes since the last analysis. So there is a bug, I will investigate it

[UlisesGascon]

I will do a PR to fix this. There is typo in the name. This discovery-orgs: 'nodesecure' should be the same name as the github login value, in this case discovery-orgs: 'NodeSecure'.

The workflow didn't find any scoring for your organization as the OpenSSF Scorecard is case sensitive:

• ✅ https://api.securityscorecards.dev/projects/github.com/NodeSecure/cli
• ❌ https://api.securityscorecards.dev/projects/github.com/nodesecure/cli

Full Debug log, just in case you want to explore it.

Note You can always run the Github Action in Debug mode, this can provide you a lot of info as I added some debug traces too 👍