Implement OpenSSF Scorecard for Continuous Security Monitoring

## Labels
`enhancement` `security` `infrastructure` `good first issue`

## Description

### Background
The OpenSSF Scorecard is an automated tool that assesses open source projects for security risks through a series of automated checks. It provides actionable recommendations to improve security posture and demonstrates our commitment to security best practices.

### Problem Statement
Currently, we lack automated, continuous monitoring of our security practices across the AirQo-api repository. This makes it difficult to:
- Proactively identify security gaps before they become vulnerabilities
- Demonstrate our security commitment to users and potential contributors
- Track security improvements over time
- Align with industry best practices and standards

### Proposed Solution
Implement the OpenSSF Scorecard GitHub Action to automatically assess our repository's security posture and provide continuous monitoring.

### Goals & Success Metrics
- ✅ Achieve initial OpenSSF Scorecard score of 5.0+
- ✅ Reach target score of 7.0+ within 3 months
- ✅ Display public Scorecard badge on README
- ✅ Automate security checks on every PR and commit
- ✅ Zero high-severity findings from Scorecard checks

---

## Implementation Tasks

### Phase 1: Setup & Configuration (Week 1-2)
- [ ] Create `.github/workflows/scorecard.yml` workflow file
- [ ] Configure Scorecard Action with appropriate permissions
- [ ] Enable `publish_results: true` to contribute to OpenSSF public dataset
- [ ] Set up SARIF upload to GitHub Code Scanning
- [ ] Configure weekly automated scans
- [ ] Add OpenSSF Scorecard badge to README.md

### Phase 2: Baseline Assessment & Quick Wins (Week 2-3)
- [ ] Run initial Scorecard assessment
- [ ] Document baseline score and findings
- [ ] Address "easy fix" items:
- [ ] Enable branch protection on `main` and `staging` branches
- [ ] Require code reviews for all PRs
- [ ] Enable Dependabot security updates
- [ ] Configure automatic dependency updates
- [ ] Set up signed commits (if not already enabled)

### Phase 3: Advanced Security Controls (Week 3-6)
- [ ] Implement findings from Scorecard checks:
- [ ] **Binary Artifacts**: Remove or document any binary files
- [ ] **CI-Tests**: Ensure tests run on all PRs
- [ ] **Code-Review**: Enforce 2+ reviewer requirement for critical paths
- [ ] **Dangerous-Workflow**: Audit GitHub Actions for security issues
- [ ] **Dependency-Update-Tool**: Configure Dependabot/Renovate
- [ ] **Fuzzing**: Explore integration with OSS-Fuzz (if applicable)
- [ ] **Maintained**: Ensure regular commit activity
- [ ] **Pinned-Dependencies**: Pin all action versions
- [ ] **SAST**: Ensure CodeQL runs comprehensively
- [ ] **Security-Policy**: Keep SECURITY.md up to date
- [ ] **Signed-Releases**: Implement signed release artifacts
- [ ] **Token-Permissions**: Set minimal GitHub token permissions
- [ ] **Vulnerabilities**: Address any known CVEs

### Phase 4: Monitoring & Continuous Improvement (Ongoing)
- [ ] Set up Slack/email notifications for Scorecard failures
- [ ] Create quarterly review process for security metrics
- [ ] Document security improvement process in CONTRIBUTING.md
- [ ] Share Scorecard results in team meetings

---

## Acceptance Criteria

### Must Have
- ✅ OpenSSF Scorecard GitHub Action successfully running weekly
- ✅ Scorecard results published to OpenSSF public API
- ✅ Scorecard badge visible on repository README
- ✅ Minimum score of 5.0 achieved
- ✅ All HIGH severity findings addressed
- ✅ SARIF results uploaded to GitHub Security tab

### Should Have
- ✅ Scorecard score of 7.0+ within 3 months
- ✅ Automated notifications for score regressions
- ✅ Documentation of all Scorecard checks and our status
- ✅ Integration with PR checks (block merge on security regressions)

### Nice to Have
- ✅ Custom Scorecard configuration for our specific needs
- ✅ Dashboard showing score trends over time
- ✅ Security metrics included in sprint retrospectives

---

## Resources & References

- [OpenSSF Scorecard Homepage](https://scorecard.dev/)
- [Scorecard GitHub Action](https://github.com/ossf/scorecard-action)
- [Scorecard Checks Documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md)
- [OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/)
- [Scorecard API Viewer](https://scorecard.dev/viewer/)

---

## Timeline & Priority

**Priority:** High
**Target Completion:** End of Q1 2025
**Estimated Effort:** 2-3 weeks of focused work + ongoing maintenance

---

## Related Issues/PRs
- Related to our recent authentication security improvements (#5240, #5341, #5402)
- Supports our security policy: https://github.com/airqo-platform/AirQo-api/security/policy

---

## Questions or Concerns?
Comment below or reach out to @[tech-lead-username] or techops@airqo.net