diff --git a/.github/workflows/ossf-analysis.yml b/.github/workflows/ossf-analysis.yml
new file mode 100644
index 0000000..9249b3f
--- /dev/null
+++ b/.github/workflows/ossf-analysis.yml
@@ -0,0 +1,48 @@
+name: OSSF Scorecard analysis workflow
+on:
+ push:
+ branches:
+ - master
+ pull_request:
+ branches:
+ - master
+
+permissions: read-all
+
+jobs:
+ analysis:
+ name: Scorecard analysis
+ runs-on: ubuntu-latest
+ permissions:
+ # Needed if using Code scanning alerts
+ security-events: write
+ # Needed for GitHub OIDC token if publish_results is true
+ id-token: write
+
+ steps:
+ - name: "Checkout code"
+ uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+ with:
+ persist-credentials: false
+
+ - name: "Run analysis"
+ uses: ossf/scorecard-action@80e868c13c90f172d68d1f4501dee99e2479f7af # v2.1.3
+ with:
+ results_file: results.sarif
+ results_format: sarif
+ publish_results: true
+
+ # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+ # format to the repository Actions tab.
+ - name: "Upload artifact"
+ uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+ with:
+ name: SARIF file
+ path: results.sarif
+ retention-days: 5
+
+ # required for Code scanning alerts
+ - name: "Upload SARIF results to code scanning"
+ uses: github/codeql-action/upload-sarif@83f0fe6c4988d98a455712a27f0255212bba9bd4 # v2.3.6
+ with:
+ sarif_file: results.sarif
diff --git a/readme.md b/readme.md
index 8b5bf10..8ebcccc 100644
--- a/readme.md
+++ b/readme.md
@@ -19,6 +19,9 @@
+
+ 
+