Require OSSF Scorecard

[nikolaydubina]

https://securityscorecards.dev

I found it very useful. In fact just by fixing my Go projects to get high score in OSSF Scorecard, I already:

1. fixed CI tests running in Pull Requests
2. hardened security
3. enabled dependabot and GraphQL
4. updated dependencies
5. ... which fixed some obscure bug user reported.

wow!

OSSF Scorecard is integrated already:

1. pkg.go.dev links to Open Source Insights, which shows OSSF Scorecard
2. it has badge

it would be simple to verify if repo has badge and is registered in OSSF Scorecards.

we may also in future to enforce minimum score (say 5) for projects.

I think it is very useful and should be standard for all projects that claim to be awesome-go

(there is literally no excuse to fixing CI and harden security... or at least try)

[nikolaydubina]

cc: @avelino

[avelino]

are you proposing that you help us correct the ci?

[nikolaydubina]

do you mean adding check that new PRs projects need to have OSSF as part of ci here? I think I can add that.

or there is something else is going on with ci here?