Scorecard #151
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Scorecard | |
| on: | |
| # Re-run when branch protection rules change, since several checks | |
| # (Branch-Protection, Code-Review) score that configuration directly. | |
| branch_protection_rule: | |
| push: | |
| branches: [main] | |
| schedule: | |
| - cron: "41 7 * * 2" | |
| # Declare default permissions as read-only. | |
| permissions: read-all | |
| concurrency: | |
| group: scorecard-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} | |
| # All `uses:` below are pinned to commit SHAs to eliminate supply-chain | |
| # risk from action-release spoofing. Bump via Dependabot (see | |
| # .github/dependabot.yml), which rewrites the SHA + version comment. | |
| jobs: | |
| analysis: | |
| name: analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Needed to upload the SARIF results to the code-scanning dashboard. | |
| security-events: write | |
| # Needed to publish results and obtain a badge (OIDC token). | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| # Publish results to the OpenSSF REST API. Required for the | |
| # public badge and the scorecard.dev viewer; only takes effect | |
| # on default-branch runs. | |
| publish_results: true | |
| # Retain the SARIF for download from the Actions run (optional). | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: SARIF file | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: Upload to code-scanning | |
| uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | |
| with: | |
| sarif_file: results.sarif |