From 5be5a37160319218355b2100292b543367174530 Mon Sep 17 00:00:00 2001 From: Nelson Spence Date: Mon, 25 May 2026 13:31:15 -0500 Subject: [PATCH] ci+docs: scope changelog token to job-level + add OpenSSF Scorecard badge MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - changelog.yml: move contents: write from the workflow top level to the release-notes job (the only job that needs it — creating the draft Release); top level is now contents: read. Fixes the OpenSSF Scorecard Token-Permissions check, which zeroes the whole (high-weight) check on ANY top-level write (0 -> ~10). - README: add the OpenSSF Scorecard badge (the API has published the project's results — live score 7.9 from scorecard.yml's post-merge run). Verified: zizmor --offline clean, actionlint clean, YAML (top-level contents: read + job-level contents: write). --- .github/workflows/changelog.yml | 4 +++- README.md | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index ec1b2b05..381be389 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -33,12 +33,14 @@ concurrency: cancel-in-progress: false permissions: - contents: write # create the GitHub Release + contents: read jobs: release-notes: name: release notes (git-cliff) runs-on: ubuntu-latest + permissions: + contents: write # create the draft GitHub Release steps: - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 with: diff --git a/README.md b/README.md index 15ac102b..56ba9bc0 100644 --- a/README.md +++ b/README.md @@ -3,6 +3,7 @@ [![CI](https://github.com/Fieldnote-Echo/ordvec/actions/workflows/ci.yml/badge.svg)](https://github.com/Fieldnote-Echo/ordvec/actions/workflows/ci.yml) [![License: MIT OR Apache-2.0](https://img.shields.io/badge/License-MIT%20OR%20Apache--2.0-blue.svg)](#license) [![MSRV](https://img.shields.io/badge/MSRV-1.89-blue.svg)](#minimum-supported-rust-version) +[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Fieldnote-Echo/ordvec/badge)](https://scorecard.dev/viewer/?uri=github.com/Fieldnote-Echo/ordvec)