Improve score on OpenSSF scorecard

[mhdawson]

https://deps.dev/project/github/nodejs%2Fnode-addon-api
https://deps.dev/project/github/nodejs%2Fnode-addon-examples

[mhdawson]

• Kevin mentioned branch protection in the last meeting.

[KevinEady]

node-addon-api (scorecard)

• Branch-Protection
  • Add branch protection on main (For GitHub, check out the steps here.)
  • Delete unused branches v2.x-staging, v1.x-staging
• Code-Review
  • Make "code reviews" mandatory in your repository configuration. (Instructions for GitHub.)
  • Enforce the rule for administrators / code owners as well. (Instructions for GitHub.)
• Add fuzzing...? (scorecard criteria, nodejs example)

node-addon-examples (scorecard)

• Add branch protection on main
• Add LICENSE file
• Make code reviews mandatory (as well as for administrators)
• Make GitHub Actions CI workflow tokens read-only
• Add CodeQL scanning similar to node-addon-api...?
• Add fuzzing...?

[mhdawson]

Add branch protection for both node-addon-api and node-addon-examples.

[mhdawson]

PR to add boilerplate files to node-addon-examples - nodejs/node-addon-examples#213

[mhdawson]

@KevinEady can you expand a bit on Make GitHub Actions CI workflow tokens read-only

[mhdawson]

PR to add best practices to node-addon-api - nodejs/node-addon-examples#214

[KevinEady]

Hi @mhdawson,

... can you expand a bit on Make GitHub Actions CI workflow tokens read-only

From Assigning permissions to jobs - GitHub Docs:

You can use permissions to modify the default permissions granted to the GITHUB_TOKEN, adding or removing access as required, so that you only allow the minimum required access.

This is for the principle of least privilege, as discussed in the Token-Permissions Check documentation.

This was mostly addressed by the SecurityBot PR nodejs/node-addon-examples#214 , eg: nodejs/node-addon-examples@a05f82c#diff-e98936aa52a6dd7416e4296e9628456227d834f7245967383fd9ff80fd985dadR9-R11 but it skipped a workflow that I added to the PR in this commit.

So once this PR is merged, we can say that the Token-Permissions issue has been addressed and we will receive full points.

[mhdawson]

@KevinEady I think I merged the PR you mentioned, so we should be able to close this now?