feat: add plugin support for OpenSSF Scorecard CLI

[mdtro]

Overview

This PR adds plugin support for OpenSSF's Scorecard CLI targeting GitHub repositories. I specifically opted for their support to authenticate as a GitHub app rather than using personal access tokens that tend to never expire.

This involves using the private key, app ID, and installation ID for GitHub's documented flow where a signed JWT is exchanged for the temporary installation access token.

scorecard expects a file path to the private key, so I've used the SDK's file provisioner to load the PEM formatted private key.

Type of change

• Created a new plugin

How To Test

1. Create a new GitHub app under your account settings (https://github.com/settings/apps)

2. Disable the webhook setting
   

3. Under "Permissions" and then "Repository permissions" grant the following:

   • Administration: Read-Only
   • Attestations: Read-Only
   • Contents: Read-Only
   • Commit Statuses: Read-Only
   • Packages: Read-Only

   I believe this is everything required for scorecard to complete its scan successfully, but there may be more required. It's outside of the scope for op to define though.

4. Keep "Only on this account" checked

5. Finish up & click "Create GitHub App"

6. Once created, you'll automatically be taken to your app's settings page

7. Make note of of the "App ID" (the entirely numeric value, not the Client ID)

8. Scroll down and click "Generate a private key" (this should automatically download the PEM file to your system)

9. Scroll back up to the top of the page and click "Install App". Install the application on your account.

10. Make note of the installation number in the URL once completed: https://github.com/settings/installations/<your-installation-id-here>

11. Create a new 1Password credential with three values:

    • key: upload the private key downloaded in the earlier step
    • App ID: copy your app ID from step 7 here (it does not need to be secret)
    • Installation ID: copy your installation ID from step 10 here (it does not need to be secret)

12. Initialize the plugin op plugin init scorecard

13. Search for the credential you created (you may be prompted to rename the private key field if you used the SSH Key credential type in 1Password)

14. Test scanning one of your repos: scorecard --repo=https://github.com/<username>/<repo-name>

Changelog

Authenticate with GitHub as a GitHub App with OpenSSF's Scorecard CLI using the new scorecard plugin to assess your repositories' security best practices.