Repository navigation
Conversation
Adds api.scorecard.dev and api.securityscorecards.dev so that Scorecard badges render in package READMEs. A new test reads the shipped Trusted-Image-Domains.json and checks that both hosts are trusted.
Laurianti
force-pushed
the
scorecard-badges-9749
branch
from
October 26, 2026 21:32
4fd9858 to
7cc9ae5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Allow OpenSSF Scorecard badges in package READMEs.
api.scorecard.devandapi.securityscorecards.devtoTrusted-Image-Domains.json. The first is the badge host in the Scorecard README. The second is the older host, still used by existing READMEs such as the example in [Feature]: Support OSSF Scorecard badges in package READMEs #9749. Today both badges render as<img src="">.img.shields.io, which is already trusted. Neither sets cookies.bestpractices.devis covered by Add bestpractices.dev as trusted image domain #10618 (same file and tests).Tests, after
.\build.ps1 -SkipCommon -SkipJobs -SkipArtifacts:ImageDomainValidatorFactsreads the realTrusted-Image-Domains.json, embedded inNuGetGallery.Factslike_ValidationIssue.cshtml, so the entries themselves are covered. The existing validator cases mock the domain check. Without the two entries, both of its cases fail.ImageDomainValidatorFacts: 17 passed, 0 failed.NuGetGallery.Facts: 11716 passed, 0 failed, 2 skipped.Closes #9749