From 7b6e86dfb7b798383966fe4c8f4d91a32866516c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=81rp=C3=A1d=20Csepi?= <csepi.arpad@outlook.com>
Date: Mon, 7 Sep 2026 16:19:26 +0200
Subject: [PATCH 1/2] feat: add openssf workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Árpád Csepi <csepi.arpad@outlook.com>
---
 .github/workflows/scorecard.yml | 51 +++++++++++++++++++++++++++++++++
 README.md                       |  2 ++
 2 files changed, 53 insertions(+)
 create mode 100644 .github/workflows/scorecard.yml

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 0000000..3b71379
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,51 @@
+# Copyright AGNTCY Contributors (https://github.com/agntcy)
+# SPDX-License-Identifier: Apache-2.0
+
+name: OpenSSF Scorecard
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '30 1 * * 6'
+  push:
+    branches: [ "main" ]
+  workflow_dispatch: {}
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        with:
+          sarif_file: results.sarif
diff --git a/README.md b/README.md
index 247f36e..61e97bb 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # SLIMA2A
 
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/agntcy/slim-a2a-python/badge)](https://scorecard.dev/viewer/?uri=github.com/agntcy/slim-a2a-python)
+
 SLIMA2A is a SLIM transport for A2A using slim's RPC protocol (srpc). It allows
 agents to communicate over the SLIM network using the A2A protocol, using SLIM
 identities for authentication and addressing.

From 8fa24555d8592872f949661183d6e4072830314d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=81rp=C3=A1d=20Csepi?= <csepi.arpad@outlook.com>
Date: Mon, 7 Sep 2026 16:29:09 +0200
Subject: [PATCH 2/2] ci: reduce permission to improve openssf score
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Árpád Csepi <csepi.arpad@outlook.com>
---
 .github/workflows/build-and-test.yaml                 | 3 +++
 .github/workflows/release-check.yaml                  | 3 +++
 .github/workflows/release-python.yaml                 | 3 +++
 .github/workflows/reusable-python-build-and-test.yaml | 3 +++
 4 files changed, 12 insertions(+)

diff --git a/.github/workflows/build-and-test.yaml b/.github/workflows/build-and-test.yaml
index 787fc1d..8deb889 100644
--- a/.github/workflows/build-and-test.yaml
+++ b/.github/workflows/build-and-test.yaml
@@ -10,6 +10,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
diff --git a/.github/workflows/release-check.yaml b/.github/workflows/release-check.yaml
index 4491230..73124f4 100644
--- a/.github/workflows/release-check.yaml
+++ b/.github/workflows/release-check.yaml
@@ -10,6 +10,9 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
diff --git a/.github/workflows/release-python.yaml b/.github/workflows/release-python.yaml
index fa8ce17..c5b8329 100644
--- a/.github/workflows/release-python.yaml
+++ b/.github/workflows/release-python.yaml
@@ -9,6 +9,9 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
diff --git a/.github/workflows/reusable-python-build-and-test.yaml b/.github/workflows/reusable-python-build-and-test.yaml
index 14f036d..58562dc 100644
--- a/.github/workflows/reusable-python-build-and-test.yaml
+++ b/.github/workflows/reusable-python-build-and-test.yaml
@@ -50,6 +50,9 @@ on:
         type: boolean
         default: true
 
+permissions:
+  contents: read
+
 jobs:
   pylint:
     runs-on: ubuntu-latest