Skip to content

chore: add OpenSSF Scorecard badge to README - #452

Merged
shenxianpeng merged 2 commits into
mainfrom
chore/scorecard-badge
Jul 2, 2026
Merged

chore: add OpenSSF Scorecard badge to README#452
shenxianpeng merged 2 commits into
mainfrom
chore/scorecard-badge

Conversation

@shenxianpeng

@shenxianpeng shenxianpeng commented Jul 2, 2026

Copy link
Copy Markdown
Member

Summary

Runs OpenSSF Scorecard and adds the badge to the README.

Scorecard Results (score: 7.4/10)

Score Check Notes
10/10 Binary-Artifacts no binaries found
10/10 CI-Tests 27/27 merged PRs checked by CI
10/10 Contributors 7 contributing organizations
10/10 Dangerous-Workflow no dangerous patterns
10/10 Dependency-Update-Tool detected
10/10 License detected
10/10 Maintained active in last 90 days
10/10 SAST run on all commits
10/10 Security-Policy detected (org-level .github repo)
10/10 Token-Permissions least privilege
10/10 Vulnerabilities 0 existing
3/10 Pinned-Dependencies not pinned by hash
0/10 Branch-Protection not enabled on development/release branches
0/10 Code-Review approvals not detected (likely token scope)
0/10 Fuzzing not fuzzed
? CII-Best-Practices network error
? Packaging not detected
? Signed-Releases no releases found

Badge

Adds the OpenSSF Scorecard badge to the README badge row, linking to the project's Scorecard results page.

Closes the Scorecard suggestion from the org-level review.

@shenxianpeng
chore: add OpenSSF Scorecard badge to README
b31b47a 
Scorecard aggregate score: 7.4/10. Adds the badge with a link to
the Scorecard results page for the project.
@shenxianpeng
shenxianpeng requested a review from a team as a code owner July 2, 2026 20:55
@netlify

netlify Bot commented Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for commit-check ready!

Name Link
🔨 Latest commit 457c502
🔍 Latest deploy log https://app.netlify.com/projects/commit-check/deploys/6a46d0e1654a9b00082e8d15
😎 Deploy Preview https://deploy-preview-452--commit-check.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@github-actions github-actions Bot added chore documentation Improvements or additions to documentation labels Jul 2, 2026
@coderabbitai

coderabbitai Bot commented Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

@shenxianpeng, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: cd4641af-fa08-4893-8454-48607567aba7

📥 Commits

Reviewing files that changed from the base of the PR and between 72ab7d3 and 457c502.

📒 Files selected for processing (2)
  • .github/workflows/main.yml
  • README.rst
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch chore/scorecard-badge

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@shenxianpeng
chore: pin all GitHub Actions by commit SHA
457c502 
Scorecard flagged Pinned-Dependencies at 3/10 because several
actions used version tags instead of commit SHAs.

- actions/checkout@v7.0.0 -> pin to SHA
- actions/setup-python@v6.3.0 -> pin to SHA
- actions/download-artifact@v8 -> pin to SHA
- actions/upload-artifact@v7 -> pin to SHA
@sonarqubecloud

sonarqubecloud Bot commented Jul 2, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@codecov

codecov Bot commented Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.89%. Comparing base (72ab7d3) to head (457c502).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files 
@@           Coverage Diff           @@
##             main     #452   +/-   ##
=======================================
  Coverage   96.89%   96.89%           
=======================================
  Files          10       10           
  Lines        1094     1094           
=======================================
  Hits         1060     1060           
  Misses         34       34

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@shenxianpeng shenxianpeng removed the documentation Improvements or additions to documentation label Jul 2, 2026
@shenxianpeng
shenxianpeng merged commit 5153477 into main Jul 2, 2026
31 checks passed
@shenxianpeng
shenxianpeng deleted the chore/scorecard-badge branch July 2, 2026 21:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

chore skip-changelog

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@shenxianpeng