chore: add OpenSSF Scorecard workflow

[nirmal-joishi-auth0]

✏️ Changes

This pull request adds a security hardening workflow. No functional changes are introduced.

OpenSSF Scorecard

This PR adds .github/workflows/scorecard.yml. It calls ossf/scorecard-action directly (SHA-pinned to v2.4.3) — no composite action wrapper, no cross-org dependency. Results are uploaded to the Code Scanning dashboard via github/codeql-action/upload-sarif.

⚠️ Before merging, review the added .github/workflows/scorecard.yml and make the changes described below, plus any other adjustments your CI environment requires.

Placeholders to fill in before merging

Placeholder	Description
publish_results: false	Default. Set to true to publish results to the public Scorecard API and enable the badge — also requires uncommenting id-token: write in the job permissions. Leave as false to keep results private (the id-token: write line can remain commented out).

🔮 Type of Change

• Standard

🔗 References

This change applies a standard automated security-scanning workflow as part of routine repository hardening.

• I explained why this change is needed.

📖 Documentation

No user-facing changes have been introduced.

• I reflected this change in the (internal and/or user-facing) documentation, or added an explanation for why no documentation update is needed.

🎯 Testing

This change adds a CI workflow only; validated by the workflow running on this PR.

• This change has integration, unit, or performance test coverage, or I explained why not.

🚀 Deployment

• This change can support multiple releases of the code serving traffic at the same time.

🔥 Rollback

Reverting this PR removes the added workflow file — no further action required.

• I explained what the rollback for this change will look like.

Summary by CodeRabbit

• New Features
  • Added automated supply-chain security analysis when changes are pushed to the main branch, with a weekly scheduled scan.
  • Scan results are available in code-scanning reports and as downloadable workflow artifacts.

[nirmal-joishi-auth0]

@auth0/project-dx-sdks-engineer-codeowner please review the files in the PR and merge the PR if all is green.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: auth0/auth0-react/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 98977dd7-8aeb-4c6e-a6ae-e444590f8096

📥 Commits

Reviewing files that changed from the base of the PR and between e5db629 and 7406d41.

📒 Files selected for processing (1)

• .github/workflows/scorecard.yml

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

A new GitHub Actions workflow runs OpenSSF Scorecard on pushes to main and on a weekly schedule. It creates a SARIF result, stores it as a workflow artifact, and uploads it to Code Scanning. The workflow skips pull-request events and uses restricted permissions.

Changes

Scorecard analysis workflow

Layer / File(s)	Summary
Run Scorecard and upload SARIF .github/workflows/scorecard.yml	The workflow checks out the repository, runs Scorecard with result publishing disabled, and uploads the SARIF output as an artifact and to Code Scanning.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Trigger as Push or weekly schedule
  participant Workflow as Scorecard workflow
  participant Checkout as Checkout action
  participant Scorecard as Scorecard action
  participant Artifact as Workflow artifact storage
  participant CodeScanning as Code Scanning
  Trigger->>Workflow: Start workflow
  Workflow->>Checkout: Check out repository
  Workflow->>Scorecard: Run analysis
  Scorecard-->>Workflow: Return results.sarif
  Workflow->>Artifact: Upload results.sarif
  Workflow->>CodeScanning: Upload SARIF results

Loading

Suggested reviewers: frederikprijck

Merge Risk: ⚪ Minimal · up to 7406d

The workflow can be merged after normal checks; its optional artifact does not contradict the decision not to publish results to the public Scorecard API.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding an OpenSSF Scorecard workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}