From c48d95cf74857dbb738103660b284e02a34cd096 Mon Sep 17 00:00:00 2001 From: Azeem Shaikh Date: Thu, 1 Sep 2022 16:10:03 +0000 Subject: [PATCH] Add docs for API Signed-off-by: Azeem Shaikh --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index c72c9dc1..9f51d29d 100644 --- a/README.md +++ b/README.md @@ -110,6 +110,9 @@ Then click "Add More Scanning Tools." The workflow is preconfigured to run on every repository contribution. After making a code change, you can view the results for the change either through the Scorecard Badge, Code Scanning Alerts or GitHub Workflow Runs. +### REST API +Starting with scorecard-action:v2, users can use a REST API to query their latest run results. This requires setting `publish_results: true` for the action and enabling `id-token: write` permission for the job (needed to access GitHub OIDC token). The API is available here: https://api.securityscorecards.dev. + ### Scorecard Badge Starting with scorecard-action:v2, users can add a Scorecard Badge to their README to display the latest status of their Scorecard results. This requires setting `publish_results: true` for the action and enabling `id-token: write` permission for the job (needed to access GitHub OIDC token). The badge is updated on every run of scorecard-action and points to the latest result. To add a badge to your README, copy and paste the below lines: