From 42545fd4c0abb0825fc7d27a5ec2f11160aea5c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <gaborjbernat@gmail.com>
Date: Mon, 2 Nov 2026 17:17:41 -0800
Subject: [PATCH] =?UTF-8?q?=F0=9F=91=B7=20ci(scorecard):=20publish=20OpenS?=
 =?UTF-8?q?SF=20results?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/scorecard.yaml | 26 ++++++++++++++++++++++++++
 README.md                        |  2 ++
 2 files changed, 28 insertions(+)
 create mode 100644 .github/workflows/scorecard.yaml

diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml
new file mode 100644
index 0000000..e010baf
--- /dev/null
+++ b/.github/workflows/scorecard.yaml
@@ -0,0 +1,26 @@
+name: 🛡️ scorecard
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "30 7 * * 2"
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions: {}
+jobs:
+  analysis:
+    name: 🛡️ Scorecard analysis
+    if: github.repository == 'tox-dev/python-discovery'
+    permissions:
+      actions: read # read workflow runs for the Packaging check
+      checks: read # read check runs for the CI-Tests and SAST checks
+      contents: read # check out and scan the repository
+      id-token: write # authenticate the results published to the scorecard API
+      issues: read # read issue activity for the Maintained check
+      pull-requests: read # read reviews for the Code-Review check
+      security-events: write # upload the SARIF results to code scanning
+      statuses: read # read commit statuses for the CI-Tests check
+    uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@e0ddedd1f8d78ed93d5eb8290f37675f6092bddf
diff --git a/README.md b/README.md
index d9e8f5a..f9370c4 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,8 @@
 [![Downloads](https://static.pepy.tech/badge/python-discovery/month)](https://pepy.tech/project/python-discovery)
 [![check](https://github.com/tox-dev/python-discovery/actions/workflows/check.yaml/badge.svg)](https://github.com/tox-dev/python-discovery/actions/workflows/check.yaml)
 [![Documentation Status](https://readthedocs.org/projects/python-discovery/badge/?version=latest)](https://python-discovery.readthedocs.io/en/latest/?badge=latest)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/tox-dev/python-discovery/badge)](https://scorecard.dev/viewer/?uri=github.com/tox-dev/python-discovery)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/16262/badge)](https://www.bestpractices.dev/projects/16262)
 
 ## What is python-discovery?