OpenSSF Scorecard is an automated tool from the Open Source Security Foundation (OpenSSF) that assesses repositories against a set of security best-practice checks and assigns each a score of 0–10. Unlike vulnerability scanners that flag specific CVEs, Scorecard evaluates the project’s security posture - whether the repository is configured to prevent vulnerabilities from being introduced in the first place.
Scorecard gives Platform Mesh continuous, public posture monitoring:
main and weekly, so policy drift is caught quickly rather than discovered in a security audit.scorecard.dev and linked via a per-repo badge, so adopters can verify the project’s security hygiene without having to audit the repositories themselves.Platform Mesh uses a reusable workflow defined in platform-mesh/.github: platform-mesh/.github/.github/workflows/job-ossf-scorecard.yml.
Each participating repository calls it from its own caller workflow. In this repository the caller is .github/workflows/ossf-scorecard.yml. It triggers on:
mainworkflow_dispatchScorecard is applied to the repositories that ship the Platform Mesh product - core services and operators, shared libraries, and shipped artifacts - as well as repositories that adopters depend on directly:
security-operator, account-operator, platform-mesh-operator, extension-manager-operatoriam-service, iam-ui, kubernetes-graphql-gateway, portal, resource-brokervirtual-workspaces, rebac-authz-webhookgolang-commons, subroutines, portal-server-lib, portal-ui-libhelm-charts, custom-images, upstream-imagesprovider-quickstart, ocm, platform-mesh.github.ioplatform-mesh/.githubSamples, templates, PoCs, and meta repositories (for example backlog, architecture, community) are intentionally excluded. Applying Scorecard to repositories that have no releases, no shipped binaries, or are meant to be copied rather than depended on produces misleading low scores on checks that do not apply. See the discussion on backlog#227 for the full rationale and the canonical list.
| Location | What you see |
|---|---|
Repository README.md |
Badge linking to the public Scorecard viewer for that repo |
| scorecard.dev viewer | Detailed breakdown of every check, with pass/fail and a short explanation |
| GitHub Security tab → Code scanning | SARIF results uploaded after each run; visible to org members |
Each check is scored independently and the overall score is a weighted average from 0 (worst) to 10 (best). The OpenSSF checks documentation explains what each check measures and how to improve it. A score of 7 or higher is generally considered a healthy posture for an actively maintained open-source project. If a check is failing, the Scorecard viewer shows the specific reason and links to remediation guidance.