Scaffold OpenSSF Scorecard GitHub Actions with a two-phase rollout.
npx skills add https://github.com/zcaceres/skills --skill openssf
Please help me install this Agent Skill. Skill: openssf Source: https://github.com/zcaceres/skills/tree/main/plugins/security/skills/openssf Command: npx skills add https://github.com/zcaceres/skills --skill openssf
This skill automates the complex setup and remediation of OpenSSF Scorecard, preventing poor security scores from appearing on public dashboards while providing a clear path to hardening your supply chain.
Invoke the security openssf skill to install the scorecard workflow and begin the two-phase security rollout.
High-intent search queries and answers about installing and using this skill.
You can automate OpenSSF Scorecard setup by scaffolding and managing GitHub Actions workflows, which installs the scorecard in a private trial mode to triage findings before going public.
Fixing supply-chain security findings involves generating a bucketed remediation plan for failing checks and applying automated file-based fixes for specific issues like token permissions and pinned dependencies.
A two-phase rollout prevents poor security scores by first installing Scorecard in a private trial mode to triage and remediate findings before integrating with a public dashboard.
Yes, you need jq and gh installed as dependencies to scaffold the OpenSSF Scorecard workflows and apply configuration fixes for supply-chain hardening.
Yes, you can apply configuration fixes automatically because the process generates a bucketed remediation plan and directly applies file-based fixes for common supply-chain security findings.
You should use a private trial mode when adding security boilerplate to a new public repository, allowing you to triage findings and harden your supply chain before public exposure.
zcaceresAutomate OpenSSF Scorecard GitHub Action installation and remediation.
adaptive-enforcement-labConsolidate GitHub Actions security patterns for CI/CD workflows.
martinholovskyAutomate CI/CD pipeline security hardening with GitHub Actions.
jrjsmrtnHarden GitHub Actions workflows with SHA-pinned actions and least-privilege permissions.
