add OSSF Best Practices and Scorecard Badge in README.md

[mmorel-35]

What does this PR do?

add OSSF Scorecard Badge in README.md

Signed-off-by: Matthieu MOREL [email protected]

[netlify]

✅ Deploy Preview for testcontainers-go ready!

Name	Link
🔨 Latest commit	db3ded9
🔍 Latest deploy log	https://app.netlify.com/sites/testcontainers-go/deploys/65b3909a7c4bce00081a7030
😎 Deploy Preview	https://deploy-preview-2118--testcontainers-go.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[mmorel-35]

Any question on this @mdelapenya ?

[mdelapenya]

Any question on this @mdelapenya ?

Hey @mmorel-35 as always, thanks for your contributions, much appreciated because they are adding value in the maintenance, so I personally love them!

I'm doubting on this one as it could be better to wait for resolving the issues/recommendations showed by the badge (please see #1823). But let's not close it, or instead we can move it to an open issue.

[mmorel-35]

Sorry, I forgot this suppression .
Let's keep this this open until the score fits your minimum level.

[mmorel-35]

What is your good enough threshold ? 7.2 seems to be a good grade to me.
WDYT ?

[mdelapenya]

Hi @mmorel-35 I've discussed about this badge internally, and I'm afraid I'm not going to add this badge at the moment. I do not see lots of projects apart from prometheus (as you shared), so I did a very quick search:

1. in the Gophers slack workspace, without many entries about the openssf badge, or even not really positive sentiment about badges, in general.
2. in the openssf web itself (https://www.bestpractices.dev/en/projects?page=2&q=golang), not many relevant projects appear there.

I do appreciate your work, so I'd keep an issue to evaluate this badge again in the future. I hope you understand 🙏

Nevertheless, your work improving the project with the things the badge promote are humungous, so please keep sending them. I'll be more than glad to review and merge them.

Thanks for your patience with this one, and see you in another review.

BTW, this is not final, so if you consider or find a great place to find projects demonstrating the value of the badge, please let me know. I'll discuss it again internally with those insights.