OpenSSF scorecard report

[ludwiglierhammer]

Work through the issues listed in OpenSSF scorecard report.

[ludwiglierhammer]

@jtsiddons: FYI, I added a new static code analysis workflow (codeql.yml).

If you like, you are welcome to help me improve the scorecard report (see above link).

[ludwiglierhammer]

@jtsiddons: I already created a PR for security policy (#54)

[ludwiglierhammer]

@jtsiddons: do you have any ideas why codeql.yml workflow is running on PRs ?

E.g. #232

on:
  push:
    branches:
      - main
    paths-ignore:
      - .github/*/*.yml
      - .pre-commit-config.yaml
      - CHANGELOG.rst
      - CI/*.txt
      - Makefile
      - docs/*/*.ipynb
      - docs/*/*.py
      - docs/*/*.rst
      - pyproject.toml
      - cdm_reader_mapper/__init__.py
  pull_request:
    branches:
      - main
  schedule:
    - cron: '30 23 * * 5'

[jtsiddons]

@jtsiddons: do you have any ideas why codeql.yml workflow is running on PRs ?

E.g. #232

on:
  push:
    branches:
      - main
    paths-ignore:
      - .github/*/*.yml
      - .pre-commit-config.yaml
      - CHANGELOG.rst
      - CI/*.txt
      - Makefile
      - docs/*/*.ipynb
      - docs/*/*.py
      - docs/*/*.rst
      - pyproject.toml
      - cdm_reader_mapper/__init__.py
  pull_request:
    branches:
      - main
  schedule:
    - cron: '30 23 * * 5'

Only thing I can think of is maybe you need to put pull_request and schedule in their own on sections?

[ludwiglierhammer]

@jtsiddons: do you have any ideas why codeql.yml workflow is running on PRs ?
E.g. #232

on:
  push:
    branches:
      - main
    paths-ignore:
      - .github/*/*.yml
      - .pre-commit-config.yaml
      - CHANGELOG.rst
      - CI/*.txt
      - Makefile
      - docs/*/*.ipynb
      - docs/*/*.py
      - docs/*/*.rst
      - pyproject.toml
      - cdm_reader_mapper/__init__.py
  pull_request:
    branches:
      - main
  schedule:
    - cron: '30 23 * * 5'

Only thing I can think of is maybe you need to put pull_request and schedule in their own on sections?

I both had an explicit CodeQL workflow in the repo and had enabled the default CodeQL setup. (I found help here: github/codeql-action#1558). I disabled the deafult one and the new codeql workflow is running 🎉