Enable OpenSSF Scorecard Action and Badge

Hi, I am Joyce from Google and I'm working on behalf of the Open Source Security Foundation to help essential open source projects to improve their supplier chain security. Given the relevance that circt has on many projects, the OpenSSF has identified it as one of the 100 most critical projects.

Would you be interested in adopting an OpenSSF tool called Scorecards? It runs dozens of automated security checks to help maintainers better understand their project's supply-chain security posture. The OpenSSF developed the Scorecard in partnership with GitHub.

I've looked into circt project scorecard results and it seems that you are already doing great on adopting security best practices and postures, but there still some path to follow, such as providing a Security Policy, SAST tool, Fuzzing, etc.

To make it simple for you to identify these next steps, the OpenSSF has also developed the Scorecard GitHub Action. It is very lightweight and runs on every change to the repository's main branch and at least once a week. The results of its checks are available on the project's security dashboard, and include suggestions on how to solve any issues (see examples below).

The Action does not run or interact with any workflows, but merely parses them to identify possible vulnerabilities. This Action has been adopted by 1800+ projects already, having some prominent users like Tensorflow, Angular, Flutter, sos.dev and deps.dev.

Would you be interested in a PR which adds this action? Optionally, it can also publish your results to the OpenSSF REST API, allowing a badge with the project's score to be added to the README file.

In case of doubts or concerns you can try to check Scoreacrds FAQ. Anyway, feel free to reach me out.

Start by reviewing the repository's existing GitHub Actions workflows and the OpenSSF Scorecard Action documentation. Add the action for changes to the main branch and a weekly run, then verify that results appear in the security dashboard; treat publishing the score and adding a README badge as optional scope.