在采用或发布决策之前，使用 Scorecard 对供应链风险信号进行评分，以评估开源仓库的风险

Check a repository against OpenSSF security heuristics before you trust it as a dependency, approve it for use, or ship from it.

Prerequisites

Scorecard CLI or GitHub Action, network access to the target repository host, and optional GitHub authentication for higher API limits.

Installation

Use the upstream install or setup path that matches your environment:
- docker pull ghcr.io/ossf/scorecard:latest
- docker pull ghcr.io/ossf/scorecard:v3.2.1
- docker run -e GITHUB_AUTH_TOKEN=token ghcr.io/ossf/scorecard:latest --show-details --repo=https://github.com/1991513ccie-png/skills
- docker run -e GITHUB_AUTH_TOKEN=token ghcr.io/ossf/scorecard:v3.2.1 --show-details --repo=https://github.com/1991513ccie-png/skills

Requirements and caveats from upstream:
- Prerequisites
- projects the world depends on.
- If OSS consumers require certain behaviors from their dependencies,

Basic usage or getting-started notes:
- Basic Usage
- Scorecard has been run on thousands of projects to monitor and track security
- For example:

• Source: https://github.com/1991513ccie-png/skills
• Extracted from upstream docs: https://raw.githubusercontent.com/ossf/scorecard/HEAD/README.md

Documentation

• https://scorecard.dev