Add OpenSSF Best Practices (CII) badge

[mrutkows]

Summary

Register the project with the OpenSSF Best Practices Program (formerly the Linux Foundation CII Best Practices badge) and add the resulting badge to the README.

What is it?

The OpenSSF Best Practices badge is a widely-recognised trust signal for open-source projects. A maintainer completes a self-attestation questionnaire covering:

• Project documentation and website
• Change control and version control practices
• Reporting and handling vulnerabilities
• Quality: working build system, automated test suite, test coverage
• Security: use of good cryptographic practices, vulnerability scanning

Badge levels: Passing → Silver → Gold

Why add it?

As a security-focused tool (SBOM validation, CycloneDX/SPDX), sbom-utility should itself demonstrate strong security hygiene. The badge gives users and integrators confidence that the project follows recognised best practices for secure, reliable OSS development.

Prerequisites for Passing level

Most criteria are already met. Items to confirm or add:

• Register project at https://www.bestpractices.dev and obtain a project ID
• Add a SECURITY.md documenting the vulnerability disclosure / reporting process (required for Passing)
• Confirm the automated test suite is documented in the README
• Confirm the project has a documented contribution process (CONTRIBUTING.md or equivalent)
• Add badge to README once registered:

[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/<ID>/badge)](https://www.bestpractices.dev/projects/<ID>)

References

• OpenSSF Best Practices: https://www.bestpractices.dev
• Criteria checklist: https://www.bestpractices.dev/en/criteria
• Example SECURITY.md (GitHub template): https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository