ci: keep the workflow hardening in place with a Plumber check and badge

.github/workflows/plumber.yml

@@ -0,0 +1,37 @@
+name: plumber
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  plumber:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      security-events: write
+      # Needed by score-push to publish the score for the README badge.
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - uses: getplumber/plumber@93ea968a173204b9a7f91df270a4e853845aefa3 # v0.7.9
+        with:
+          # Code scanning upload needs security-events write, which PRs
+          # from forks do not get. The report stays available as a
+          # workflow artifact there.
+          upload-sarif: ${{ github.event.pull_request.head.repo.fork != true }}
+          # Publishes the score to score.getplumber.io, which feeds the
+          # badge in the README. A failed push never fails the run.
+          score-push: true
+          # Gate at 85 points instead of the all-or-nothing default,
+          # leaves room for a small finding without blocking PRs.
+          min-points: 85

.plumber.yaml

@@ -0,0 +1,30 @@
+# Plumber overlay: inherits every control from the CLI's built-in
+# baseline, only the differences for this repository are written here.
+# Run 'plumber config resolve' to see the full effective config.
+extends: plumber:default
+version: '2.0'
+
+github:
+  controls:
+    githubActionMustComeFromAuthorizedSources:
+      # Keep the curated default list and trust the runner, change
+      # detection and release tooling this repository uses on top of
+      # it, all pinned by commit.
+      includePlumberDefaults: true
+      trustedGithubActions:
+        - dorny/paths-filter
+        - nschloe/action-cached-lfs-checkout
+        - ppremk/lfs-warning
+        - samuelcolvin/check-python-version
+        - tj-actions/changed-files
+        - useblacksmith/build-push-action
+        - useblacksmith/checkout
+        - useblacksmith/setup-docker-builder
+
+    # main is protected. The release/* branches are frozen history
+    # from earlier releases, keep the requirement on the branch
+    # releases are actually cut from.
+    branchMustBeProtected:
+      defaultMustBeProtected: true
+      namePatterns:
+        - main

README.md

@@ -7,6 +7,7 @@
 [![discord badge]][discord link] [![latest release badge]][latest release link] [![github stars badge]][github stars link] [![github forks badge]][github forks link] [![latest commit to main badge]][latest commit to main link] [![github open issues badge]][github open issues link] [![github open prs badge]][github open prs link] [![translation status badge]][translation status link]
 
 [![Sponsor Invoke](https://img.shields.io/badge/Sponsor-Invoke-ea4aaa?logo=githubsponsors&logoColor=white)][sponsor link]
+[![Plumber Score](https://score.getplumber.io/github.com/invoke-ai/InvokeAI.svg)](https://score.getplumber.io/github.com/invoke-ai/InvokeAI)
 
 </div>