Add OSSF Scorecard workflow to gh-workflows module

[erikgb]

This adds a slightly modified version of https://github.com/cert-manager/cert-manager/blob/6c9253775a067378b6d237982fab105601611901/.github/workflows/scorecards.yml to the gh-workflows module. This should ensure we get code scanning in all cert-manager projects using makefile-modules.

Compared with the original, I have modified the following:

• Added a generated note header
• Removed the cron schedule, as pushes to the default branch probably will happen often enough
• Extended the push clause with both our variants of default branch name: main and master
• Changed file extension from .yml to .yaml (this will require a manual upgrade in cert-manager)

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign maelvls for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[erikgb]

/cc @inteon

[erikgb]

@inteon, this should be ready for review now.

[inteon]

@erikgb are we sure this will not run on private forks?

[erikgb]

@erikgb are we sure this will not run on private forks?

That's a good point, but then we have the issue in cert-manager already. I will fix it.

[erikgb]

Fixed your remark now, @inteon. PTAL! 🙏

[Copilot]

Pull request overview

Adds an OSSF Scorecard GitHub Actions workflow to the gh-workflows module and wires it into the repo so downstream consumers can generate the same workflow into their repositories.

Changes:

• Introduces a new scorecards.yaml workflow template under modules/gh-workflows/base/ and a generated copy under .github/workflows/.
• Adds a generate-gh-workflows make target to copy the module’s base workflow files into the repository.
• Updates Renovate configuration to ignore updates to the generated Scorecards workflow file.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
renovate-config.json5	Ignores Renovate updates for the generated Scorecards workflow.
modules/gh-workflows/base/.github/workflows/scorecards.yaml	Adds the source-of-truth Scorecards workflow template used by the module.
modules/gh-workflows/01_mod.mk	Adds a generator target to copy module base workflows into the repo.
.github/workflows/scorecards.yaml	Adds the generated Scorecards workflow in the repository root.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[erikgb]

Updated description.

[erikgb]

/cc @wallrj

I have addressed the comments from Copilot now.