From 4769daa949a4cee3475b91cda6194b407c9138da Mon Sep 17 00:00:00 2001
From: arpan <contact@arpanghoshal.com>
Date: Sun, 13 Sep 2026 15:35:30 +0530
Subject: [PATCH] Badge row: the OpenSSF Best Practices badge, project 14615,
 beside the Scorecard

Signed-off-by: arpan <contact@arpanghoshal.com>
---
 generated/badges.readme.md        | 1 +
 tools/docs_audit/render_badges.py | 8 +++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/generated/badges.readme.md b/generated/badges.readme.md
index 1351063..0db6930 100644
--- a/generated/badges.readme.md
+++ b/generated/badges.readme.md
@@ -10,6 +10,7 @@
   <a href="https://ctrlrun.dev/docs/how-this-is-built"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/CTRLRun/ctrlrun/badges/tests-badge.json" alt="Tests"></a>
   <a href="https://ctrlrun.dev/docs/security/verify-guarantees"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/CTRLRun/ctrlrun/badges/verify-badge.json" alt="CTRLRun verified"></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/CTRLRun/ctrlrun"><img src="https://api.scorecard.dev/projects/github.com/CTRLRun/ctrlrun/badge" alt="OpenSSF Scorecard"></a>
+  <a href="https://www.bestpractices.dev/projects/14615"><img src="https://www.bestpractices.dev/projects/14615/badge" alt="OpenSSF Best Practices"></a>
   <a href="https://github.com/CTRLRun/ctrlrun/blob/main/LICENSE"><img src="https://img.shields.io/pypi/l/ctrlrun?color=B8730A" alt="License"></a>
 </p>
 <!-- end generated -->
diff --git a/tools/docs_audit/render_badges.py b/tools/docs_audit/render_badges.py
index efcc64f..e61fb36 100644
--- a/tools/docs_audit/render_badges.py
+++ b/tools/docs_audit/render_badges.py
@@ -83,7 +83,8 @@ class Badge:
 
 #: The row, in reading order: how often it is cloned, what it is, how often it is installed,
 #: where it is documented, that it builds, is analysed and is fuzzed, that its own suite is this
-#: big, that its guarantees were checked, how its supply chain scores, and the licence. Every entry is a
+#: big, that its guarantees were checked, how its supply chain scores, which best practices it
+#: self-certifies (each answer is a URL a reader can check), and the licence. Every entry is a
 #: claim a reader can follow to the thing that measured it; an entry that is not stops being a
 #: badge and becomes decoration, which is the test the three removed ones failed.
 BADGES: tuple[Badge, ...] = (
@@ -137,6 +138,11 @@ class Badge:
         "https://api.scorecard.dev/projects/github.com/CTRLRun/ctrlrun/badge",
         "https://scorecard.dev/viewer/?uri=github.com/CTRLRun/ctrlrun",
     ),
+    Badge(
+        "OpenSSF Best Practices",
+        "https://www.bestpractices.dev/projects/14615/badge",
+        "https://www.bestpractices.dev/projects/14615",
+    ),
     Badge(
         "License",
         "https://img.shields.io/pypi/l/ctrlrun?color=B8730A",