Create scorecard.yml

[kotakanbe]

Add a GitHub Actions workflow (ossf/scorecard-action@v2 with a read-only PAT) to generate a complete OSSF Scorecard and resolve the Branch-Protection “?” score.
https://scorecard.dev/viewer/?uri=github.com%2Ffuture-architect%2Fvuls

Executed exactly as per the instructions in the OSSF Scorecard Action marketplace guide.
https://github.com/marketplace/actions/ossf-scorecard-action

Security enhancements:

• Added a new workflow file .github/workflows/scorecard.yml to perform supply-chain security analysis using the OpenSSF Scorecard action. This includes checks for branch protection and maintenance updates.
• Configured the workflow to run on the default branch and on a schedule, with permissions set to read-all by default and additional permissions for security events and ID tokens as needed.
• Integrated steps to:
  • Checkout the repository code using actions/checkout (v4.2.2).
  • Run the Scorecard analysis using ossf/scorecard-action (v2.4.1), with support for SARIF results and optional publishing of results for public repositories.
  • Upload SARIF results as artifacts and to GitHub's code scanning dashboard for enhanced visibility.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

not tested

Checklist:

• Write tests
• Write documentation
• Check that there aren't other open pull requests for the same issue/feature
• Format your source code by make fmt
• Pass the test by make test
• Provide verification config / commands
• Enable "Allow edits from maintainers" for this PR
• Update the messages below

Is this ready for review?: YES

[Copilot]

Pull Request Overview

This pull request adds a new GitHub Actions workflow to perform a supply-chain security analysis using the OSSF Scorecard action.

• Adds a workflow file to trigger branch-protection and maintenance checks via scheduled runs and pushes.
• Configures steps to checkout the repository, run the Scorecard analysis, and upload SARIF results as artifacts and to GitHub's code scanning dashboard.

[shino]

🍻