✨ Add Script Injection to Dangerous-Workflow

[asraa]

Signed-off-by: Asra Ali [email protected]

• Please check if the PR fulfills these requirements

• [ x] Tests for the changes have been added (for bug fixes / features)
• [ x] PR title follows the guidelines defined in https://github.com/ossf/scorecard/blob/main/CONTRIBUTING.md#pr-process

• What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)
  Feature: Adds script injection to Dangerous-Workflow check
  https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections

• What is the current behavior? (You can also link to an open issue here)
  part of New check: Check for dangerous code practices in github workflows #426

• What is the new behavior (if this is a feature change)?
  Adds a new check.
  feedback would like feedback on the scoring for this check. Right now if any fails, you get a 0

• Does this PR introduce a breaking change? (What changes might users need to make in their application due to this PR?)

• Other information:

[asraa]

cc @haydentherapper just fyi!

[github-actions]

Integration tests success for
[cfa69b3]
(https://github.com/ossf/scorecard/actions/runs/1545890254)

[github-actions]

Integration tests success for
[0a8169a]
(https://github.com/ossf/scorecard/actions/runs/1545889884)

[azeemshaikh38]

LGTM. Would be good to have some more unit tests for untrusted workflows.

[asraa]

added more tests!

[github-actions]

Integration tests success for
[964b322]
(https://github.com/ossf/scorecard/actions/runs/1551022877)

[github-actions]

Integration tests success for
[e275909]
(https://github.com/ossf/scorecard/actions/runs/1551024305)

[laurentsimon]

This is exciting!

[github-actions]

Integration tests success for
[275877f]
(https://github.com/ossf/scorecard/actions/runs/1554272847)

[github-actions]

Integration tests success for
[4ef2f08]
(https://github.com/ossf/scorecard/actions/runs/1560463947)

[laurentsimon]

Thanks @asraa !