Skip to content

OpenSSF Scorecard: assessing repositories

Security · Supply chain
Not studied

Added 2026-10-29.

Problem

Dependencies are chosen by stars and description. Unpinned actions, dangerous CI triggers and abandonment only show up when you read the repository, and there's no time for that.

Solution

Scorecard was created "to help open source maintainers improve their security best practices and to help open source consumers judge whether their dependencies are safe". It "is an automated tool that assesses a number of important heuristics ("checks") associated with software security". Run it against a repository before adopting it, and regularly against your own. The individual checks are more useful than the overall score: Pinned-Dependencies, Dangerous-Workflow, Token-Permissions, Maintained, Code-Review.

Example

export GITHUB_AUTH_TOKEN=<read-only token>
scorecard --repo=github.com/aquasecurity/trivy \
  --checks=Pinned-Dependencies,Dangerous-Workflow,Token-Permissions \
  --show-details

Your own GitLab:

export GITLAB_AUTH_TOKEN=<read token>
scorecard --repo=gitlab.example.ru/infra/devops-kb
# if GitLab is served under a path like host/prefix/: export GL_HOST=host/prefix

The main support target is GitLab.com; verify that self-hosted GitLab CE works on your own instance.

When to use

Before adding a new dependency or tool to CI, and quarterly for your own repositories.

Source

How to apply it yourself

  1. Run it against three tools that already run in CI.
  2. Work through the Pinned-Dependencies and Dangerous-Workflow findings.
  3. Run it against your own GitLab repository.
  4. Mark it "Studied" once the check has become a step in choosing new tools.