How do I connect OpenSSF Scorecard to Lodol?

Authenticate OpenSSF Scorecard once from your workspace and every action and trigger it supports becomes available to drop into a workflow. There is no glue code to write or maintain.

All integrations

OpenSSF Scorecard

SecurityCode Repositories

Check how well an open source project is looked after with OpenSSF Scorecard, the Open Source Security Foundation's automated review of a repository's security practices. Score any project on GitHub or GitLab out of 10 and read the checks behind it: is it actively maintained, is code reviewed before it lands, are releases signed, are dependencies pinned and kept up to date, are there known unfixed vulnerabilities. Rank a set of dependencies weakest first, hold a release when one falls below your bar, or put a project's badge in a README. No account or API key is required.

Get Started Browse all integrations

4 actions

Actions

Steps your workflow can run in OpenSSF Scorecard.

Get repository scorecardGet an open source project's OpenSSF Scorecard: its overall score out of 10 and every check behind it, weakest first, so the top of the list is what to fix. Each check says what it looks for, how serious it is, and why it scored what it did. Scorecard reports a check it could not evaluate with the same number it would use for a catastrophic failure, so those come back marked as unanswered rather than as a zero, and the date of the analysis comes back with its age, because a published result can be years old.

Compare repositoriesScore several open source projects at once and rank them weakest first, so the dependency to look at is the one at the top. Each row carries the project's score, how old the analysis is, and the checks it scored worst on. Projects Scorecard has never analysed are listed separately rather than ranked last as though they had scored badly, and they are left out of the average for the same reason.

Check security requirementsAnswer one question about a set of open source projects: do they meet the bar? Set a minimum score, optionally name the checks that matter to you, and each project comes back as a pass or a fail with the reasons written out in plain words, ready to hold a release, open a ticket or send an alert. A project with no published result, a check Scorecard could not evaluate, and a result too old to trust all fail rather than quietly pass, and each says which of the three it was.

Get scorecard badgeGet a project's OpenSSF Scorecard badge, ready to paste into a README or a status page as Markdown, as HTML, or as the image address on its own, each linking through to the full report. Because a badge renders as an error for a project Scorecard has never analysed, this also reports the current score and says plainly whether the badge will show one.