Bring CLOMonitor score to 100%

[eddie-knight]

As Argo is signed up for the Security Slam, this issue is to track the efforts necessary to bring argo-rollouts CLOMonitor score to 100%.

CLOMonitor report

Summary

Repository: argo-rollouts
URL: https://github.com/argoproj/argo-rollouts
Checks sets: CODE
Score: 86

Checks passed per category

Category	Score
Documentation	100%
License	75%
Best Practices	94%
Security	80%
Legal	n/a

Checks

Documentation [100%]

• Changelog (docs)
• Contributing (docs)
• Maintainers (docs)
• Readme (docs)

License [75%]

• Apache-2.0 (docs)
• Approved license (docs)
• License scanning (docs)

Best Practices [94%]

• Artifact Hub badge (docs)
• Contributor License Agreement (docs) EXEMPT
• Developer Certificate of Origin (docs)
• OpenSSF badge (docs)
• Recent release (docs)

Security [80%]

• Binary artifacts (docs)
• Code review (docs)
• Dangerous workflow (docs)
• Dependency update tool (docs)
• Maintained (docs)
• Software bill of materials (SBOM) (docs)
• Security policy (docs)
• Signed releases (docs)
• Token permissions (docs)

For more information about the checks sets available and how each of the checks work, please see the CLOMonitor's documentation.

[zachaller]

Releases are now signed https://quay.io/repository/argoproj/argo-rollouts?tab=tags