Improve ITK's OpenSSF scores

[jhlegarreta]

Description

As of Dec 16, 2024 ITK's OpenSSF scores are the following:

Holistic security practices

Category	Group	Metric	Score
	1	CI-Tests	10
	1	Fuzzing	0
	1	SAST	0
	2	CII-Best-Practices	0
	2	Dependency-Update-Tool	0
	2	License	10
	2	Maintained	10
	2	Security-Policy	0
	3	Vulnerabilities	10

Holistic security practices

Category	Metric	Score
	Binary-Artifacts	10
	Branch-Protection	8
	Code-Review	10
	Contributors	10
	Dangerous-Workflow	-1

Build risk assessment

Category	Metric	Score
	Packaging	-1
	Pinned-Dependencies	0
	Signed-Releases	0
	Token-Permissions	-1

Metric	Score
Total Score	5.3

So the following aspects need improvement:

• Fuzzing
• SAST
• CII-Best-Practices
• Dependency-Update-Tool
• Security-Policy
• Branch-Protection
• Dangerous-Workflow
• Packaging
• Pinned-Dependencies
• Signed-Releases
• Token-Permissions

Check current scores at https://scorecard.dev/viewer/

Impact analysis

Scoring high on each of the above aspects would improve the security of the ITK code and/or the infrastructure it uses and provide some safety guarantee to consumers.

Expected behavior

ITK scrores high in OpenSSF scores.

Actual behavior

ITK scrores in OpenSSF have room for improvement.

Versions

master

Environment

N/A

Additional Information

Related to PR #5078.

More information: https://github.com/ossf/scorecard

Some items may not apply to ITK, and thus may need to be bypassed in the evaluation, and some others are maybe not being processed correctly (e.g. signed releases).