Get semantic-release added as a supported tool for packaging for the OpenSSF Scorecard

Métricas do repositório

Stars: (19.681 estrelas)
Métricas de merge de PR: (Mesclagem média 3h 15m) (33 fundiu PRs em 30d)

Description

New feature motivation

Since semantic-release is not currently detected as a valid automated workflow packaging tool, projects publishing with it currently receive a low score for the "Packaging" check and also get dinged on the "Token Permissions" check because of the need to grant contents: write

New feature description

No changes to semantic-release itself, but work through the process of getting appropriate details about semantic-release added to the ossf/scorecard project so that semantic-release is recognized as a valid packaging tool for automated workflows.

New feature implementation

contribute semantic-release as a valid tool for packaging following the details found at https://github.com/ossf/scorecard/blob/27cfe92ed356fdb5a398c919ad480817ea907808/docs/checks.md#packaging

this PR added support for python-semantic-release, so it hopefully provides some details for getting the conversation started: https://github.com/ossf/scorecard/pull/1654

Guia do colaborador

Direção de pesquisa: Revise a documentação do OpenSSF Scorecard sobre como adicionar uma ferramenta de empacotamento em https://github.com/ossf/scorecard/blob/main/docs/checks.md#packaging. Examine o PR de exemplo para python semantic release (https://github.com/ossf/scorecard/pull/1654) para entender as alterações necessárias. Em seguida, proponha modificações no repositório ossf/scorecard para incluir o semantic release como uma ferramenta de empacotamento reconhecida, garantindo que a verificação de permissões de token seja atualizada de acordo.
Pilha de tecnologia: javascript
Domain: devops
Tipo Issue: Funcionalidade
Difficulty: 2
Tempo estimado: Meio dia
Status da atividade: Ativo
Clarity: Claro
Prerequisites: Git
Simpatia para novatos: 80