ci(scorecard): auto-publish badge.json to badges branch

.github/workflows/scorecard.yml

@@ -15,7 +15,7 @@ jobs:
     permissions:
       security-events: write
       id-token: write
-      contents: read
+      contents: write
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -36,3 +36,44 @@ jobs:
       - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
         with:
           sarif_file: results.sarif
+
+      - name: Update badge JSON
+        if: github.ref == 'refs/heads/master'
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import json
+          import urllib.request
+
+          url = "https://api.scorecard.dev/projects/github.com/masdevid/mt5-quant"
+          with urllib.request.urlopen(url) as resp:
+              data = json.load(resp)
+
+          score = float(data["score"])
+          if score >= 9:
+              color = "brightgreen"
+          elif score >= 7:
+              color = "yellowgreen"
+          elif score >= 5:
+              color = "yellow"
+          else:
+              color = "red"
+
+          badge = {
+              "schemaVersion": 1,
+              "label": "OpenSSF Scorecard",
+              "message": f"{score:g}",
+              "color": color,
+          }
+          with open("badge.json", "w") as f:
+              json.dump(badge, f)
+          print("Wrote badge.json:", badge)
+          PY
+
+          git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git"
+          git checkout -B badges
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add -f badge.json
+          git commit -m "chore: update OpenSSF Scorecard badge" || echo "no changes to commit"
+          git push -f origin badges

README.md

@@ -1,6 +1,6 @@
 # MT5-Quant
 
-[![OpenSSF Scorecard](https://img.shields.io/badge/OpenSSF%20Scorecard-7.2-yellowgreen)](https://scorecard.dev/viewer/?uri=github.com/masdevid/mt5-quant) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/14227/badge)](https://bestpractices.coreinfrastructure.org/projects/14227) [![Rust CI](https://github.com/masdevid/mt5-quant/actions/workflows/rust.yml/badge.svg)](https://github.com/masdevid/mt5-quant/actions/workflows/rust.yml) [![crates.io](https://img.shields.io/crates/v/mt5-quant.svg)](https://crates.io/crates/mt5-quant) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![OpenSSF Scorecard](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/masdevid/mt5-quant/badges/badge.json)](https://scorecard.dev/viewer/?uri=github.com/masdevid/mt5-quant) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/14227/badge)](https://bestpractices.coreinfrastructure.org/projects/14227) [![Rust CI](https://github.com/masdevid/mt5-quant/actions/workflows/rust.yml/badge.svg)](https://github.com/masdevid/mt5-quant/actions/workflows/rust.yml) [![crates.io](https://img.shields.io/crates/v/mt5-quant.svg)](https://crates.io/crates/mt5-quant) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
 **MCP server for MT5 strategy development on macOS/Linux.** 89 tools to compile, backtest, analyze, optimize, debug crashes, and manage MQL5 Expert Advisors — no Windows required.