Adopt open source security foundation best practices

[fcollonval]

References

Fixes #16010

Code changes

None

It adds a new workflow to automatically analyze our practices performance against the OpenSSF best practices. The goal is to proactively monitor and improve our practices.

-> The OpenSSF best practices form for our project is https://www.bestpractices.dev/en/projects/8675.

User-facing changes

We are improving our practices 😉

Backwards-incompatible changes

None

[jupyterlab-probot]

Thanks for making a pull request to jupyterlab!
To try out this branch on binder, follow this link:

[rpwagner]

@fcollonval also opened an issue in the Security Subproject repository. This is a duplicate of my comment there so it gets seen a bit more broadly.

In addition to the badge, the OpenSSF Best Practices Working Group maintains a set of guides, including the Concise Guide for Developing More Secure Software. One of the simplest things we could do is to adopt the practices in the Concise Guide that apply to Project Jupyter Subprojects. We wouldn't be able to do that right away, but it would give us a direction and a way to track our progress.

Also, OpenSSF is part of the Linux Foundation, so this has adoption by a wider open source community and may help if Project Jupyter does transition to the LF.

[krassowski]

This looks relevant: https://github.blog/changelog/2024-03-20-openssf-scorecard-info-is-now-available-in-the-dependency-review-action/

[krassowski]

It looks good but there are two relevant CI failures before we can merge it:

• the docs job failure due to warning that the new file is not included in ToC
• the pre-commit complaining about whitespaces or newlines