Added Node.js CII Best practices badge

[UlisesGascon]

Related:

• Node.js Security WorkGroup Meeting 2023-06-08 security-wg#1012
• Assessment against best practices (OpenSSF Scorecards ...) security-wg#859

cc: @nodejs/security

Note:

This is a requirement for the silver level ( nodejs/security-wg#955 )

[mscdex]

Can't this go on the website instead of the README? I thought we weren't allowing badges in the README?

[tniessen]

I do not like badges in the README either. I assume this is the requirement:

The project repository front page and/or website MUST identify and hyperlink to any achievements, including this best practices badge, within 48 hours of public recognition that the achievement has been attained. (URL required)

So website should be fine.

[ronag]

I'm not sure what value this brings and the references don't bring much clarity for me.

[mhdawson]

@tniessen, @mscdex for my benefit what is the concerns over badges in the README?

[mhdawson]

I thought we weren't allowing badges in the README?

@mscdex do you have a link to where that is documented? Just want to make sure we've captured it somewhere if it was agreed and any related context to go along with it.

[mscdex]

@mhdawson This is based on prior PRs which attempted to add various badges to the README. It's not something that was ever formally codified. One example I found after a brief search was this PR.

Funnily enough, my brief search also revealed that this specific CII badge had already been added to the README long ago and then was removed later on.

Additionally this CII badge was rejected from being re-added just awhile ago back in March of this year (and apparently undici decided against it as well at the time).

[mhdawson]

@mscdex thanks finding/sharing all of that context. I'm thinking it would be good to codify somewhere in our contributing docs so that we don't re-discuss each time. I know that @UlisesGascon had asked in the security team meeting where we should add REAMDE/website and I suggested the README.

From reading through those discussions/PRs I think the consensus seems to be along the following lines:

The project has decided not to include badges on it's README.md as they don't don't add enough value and context to be useful. For badges that require a link to the badge be posted that should be done on the Nodejs.org website instead.

What I'm not sure of where to say they should be shared on the Website. I don't think the home makes sense to me, maybe the about page?

[UlisesGascon]

Thanks for the feedback and all the historical context @mscdex. I also think that based on this discussion, we can close this PR now. I will create a separate issue to discuss where to locate the badge on the website with the website team.