OpenSSF Scorecard for VibeControls

@vibecontrols/vibe-plugin-security-scorecard serves the main.merge lifecycle stage. It registers itself with @vibecontrols/vibe-plugin-security under the per-stage provider type security.scorecard and the provider name openssf-scorecard. It wraps the OpenSSF Scorecard checks — running offline against a local clone for the file-only checks, and switching to the remote repo URL when GH_TOKEN is available on the agent host so the full check set runs (branch protection, signed commits, CI tests, etc.).

Wave 2 scaffold — real tool integration is pending; see src/provider.ts TODO.

Install

vibe plugin install @vibecontrols/vibe-plugin-security-scorecard
vibe security providers set-default --stage main.merge --provider openssf-scorecard

The scorecard binary is downloaded automatically on first use (sha256-verified per platform) into ~/.boff/vibecontrols/agents/<profile>/tools/scorecard/.

Behavior (planned)

Offline mode (no GH_TOKEN):

• scorecard --repo file://<repoLocalPath> --format json — runs the file-only checks: Binary-Artifacts, License, Maintained, Pinned-Dependencies, Token-Permissions, CI-Tests (detected via .github/workflows/*).

Online mode (GH_TOKEN set):

• scorecard --repo <repoUrl> --format json — runs the full check set: Branch-Protection, Signed-Releases, Code-Review, Vulnerabilities, Dependency-Update-Tool, SAST, Fuzzing, Security-Policy, Webhooks.

Per-check findings are normalized to category: "policy" with severity derived from the score (0-3 = high, 4-6 = medium, 7-8 = low, 9-10 = info). The raw scorecard JSON is returned as evidence.

Configuration

Per-vibe config (stored in RepositorySecurityConfig.pluginAssignments["main.merge"].config):

provider: openssf-scorecard
config:
  checks: [] # subset of scorecard checks to run; empty = all
  online: auto # auto = use GH_TOKEN if present; force-offline / force-online overrides