Add OpenSSF Scorecard Analysis workflow

.github/workflows/openssf-scorecard-analysis.yml

@@ -0,0 +1,39 @@
+name: OpenSSF Scorecard Analysis
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches: ["main"]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: "Pull OpenSSF Scorecard image"
+        run: docker pull ghcr.io/ossf/scorecard/v5:latest
+
+      - name: "Run OpenSSF Scorecard analysis"
+        env:
+          # A dedicated token is required as explained in
+          # https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
+          GITHUB_AUTH_TOKEN: ${{ secrets.SCORECARD_TOKEN }}
+        run: |
+          docker run \
+            -e GITHUB_AUTH_TOKEN \
+            ghcr.io/ossf/scorecard/v5:latest \
+            --repo=${{ github.server_url }}/${{ github.repository }} \
+            --show-details \
+            --format=json > scorecard-results.json
+
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: openssf-scorecard-results
+          path: scorecard-results.json
+          retention-days: 90