Changes to improve CLOMonitor Score

Signed-off-by: John Kjell <[email protected]>

.clomonitor.yml

@@ -0,0 +1,7 @@
+# CLOMonitor metadata file
+# This file must be located at the root of the repository
+
+# Checks exemptions
+exemptions:
+  - check: artifacthub_badge # Check identifier (see https://github.com/cncf/clomonitor/blob/main/docs/checks.md#exemptions)
+    reason: "Project is a library and does not create an artifact" # Justification of this exemption (mandatory, it will be displayed on the UI)

.github/workflows/fossa.yml

@@ -0,0 +1,30 @@
+name: "Fossa Scan"
+
+on:
+    push:
+      branches: ["main"]
+    pull_request:
+      # The branches below must be a subset of the branches above
+      branches: ["main"]
+    schedule:
+      - cron: "0 0 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+    fossa-scan:
+      runs-on: ubuntu-latest
+      steps:
+        - name: "Checkout Code"
+          uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        - name: Check secret
+          id: checksecret
+          uses: ./.github/actions/exists
+          with:
+            value: ${{ secrets.fossaApiKey }}
+        - name: "Run FOSSA Scan"
+          if: steps.checksecret.outputs.result == 'true'
+          uses: fossas/fossa-action@f61a4c0c263690f2ddb54b9822a719c25a7b608f # v1.3.1
+          with:
+            api-key: ${{ secrets.fossaApiKey }}

README.md

@@ -1,3 +1,6 @@
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/8164/badge)](https://www.bestpractices.dev/projects/8164)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/in-toto/go-witness/badge)](https://securityscorecards.dev/viewer/?uri=github.com/in-toto/go-witness)
+[![FOSSA Scan](https://app.fossa.com/projects/git%2Bgithub.com/in-toto/go-witness?ref=badge_shield&issueType=license)](https://app.fossa.com/api/projects/git%2Bgithub.com/in-toto/go-witness.svg?type=shield&issueType=license)
 
 [![asciicast](https://asciinema.org/a/2DZRRh8uzrzHcUVL8md86Zj4D.svg)](https://asciinema.org/a/2DZRRh8uzrzHcUVL8md86Zj4D)
 

SECURITY-INSIGHTS.yml

@@ -0,0 +1,10 @@
+header:
+  schema-version: 1.0.0
+  expiration-date: '2024-08-31T10:10:09.000Z'
+  last-updated: '2023-12-06'
+  last-reviewed: '2023-12-06'
+  commit-hash: cd0c222058a8830a8e190b840e466098b25a3c41
+  project-url: https://github.com/in-toto/go-witness
+  project-release: 'v0.17.0'
+  changelog: https://github.com/in-toto/go-witness/releases/tag/v0.17.0
+  license: https://github.com/in-toto/go-witness/blob/main/LICENSE