Maintenance: Improve security posture by addressing OpenSSF results

[sthulb]

Summary

We recently added OpenSSF Scorecard to the repository, on the initial scan, it found a few actionable items.

Why is this needed?

OpenSSF Scorecard scanner found minor issues with the project that we should improve on.

Which area does this relate to?

Governance

Solution

No response

Acknowledgment

• This request meets Powertools for AWS Lambda (TypeScript) Tenets
• Should this be considered in other Powertools for AWS Lambda languages? i.e. Python, Java, and .NET

Future readers

Please react with 👍 and your use case to help us understand customer demand.

[dreamorosi]

The "on new PR" workflow is failing due to it attempting to obtain more elevated permissions than the caller workflow - see an example here.

Would appreciate if you could take a look.

cc @am29d.

[dreamorosi]

The "On PR merge" workflow is also failing due to permission issues: https://github.com/aws-powertools/powertools-lambda-typescript/actions/runs/7292228413/job/19872848955

[dreamorosi]

With the release workflow merged we have completed most of the work needed for the OpenSSF scorecard.

After discussing internally, these are the pending items for the next iteration, after which we can close the topic:

• Add top-level contents: read permission to this workflow chore(ci): pull up update_layer_arn_docs and scope contents permissions #2043
• Compare remaining findings from the scorecard with the Python repo, and mark as resolved all the ones that must have contents: write by design
• Display scorecard badge on the readme

[dreamorosi]

With #2072 being merged we can now consider concluded the work needed to improve the security posture of the project.

Our current baseline score is 9.3:

[github-actions]

⚠️ COMMENT VISIBILITY WARNING ⚠️

This issue is now closed. Please be mindful that future comments are hard for our team to see.

If you need more assistance, please either tag a team member or open a new issue that references this one.

If you wish to keep having a conversation with other community members under this issue feel free to do so.