|
12 | 12 | # See the License for the specific language governing permissions and |
13 | 13 | # limitations under the License. |
14 | 14 |
|
| 15 | +# yamllint disable rule:line-length |
| 16 | + |
15 | 17 | name: Scorecard analysis |
16 | 18 | run-name: Run Scorecard scanner for security best practices |
17 | 19 |
|
@@ -62,24 +64,25 @@ jobs: |
62 | 64 | persist-credentials: false |
63 | 65 |
|
64 | 66 | - name: Run Scorecard analysis |
65 | | - # yamllint disable rule:line-length |
66 | 67 | uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 |
67 | 68 | with: |
68 | 69 | # Save the results |
69 | 70 | results_file: scorecard-results.sarif |
70 | 71 | results_format: sarif |
71 | | - # See https://github.com/ossf/scorecard-action#publishing-results. |
72 | | - publish_results: true |
| 72 | + # Only publish results for non-fork PRs or scheduled runs. |
| 73 | + publish_results: >- |
| 74 | + ${{github.event_name != 'pull_request' |
| 75 | + || github.event.pull_request.head.repo.fork == false}} |
73 | 76 |
|
74 | 77 | - name: Upload results to code-scanning dashboard |
75 | | - # yamllint disable rule:line-length |
| 78 | + # Skip upload for fork PRs to avoid "Analysis configuration not found" / 404 errors. |
| 79 | + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false |
76 | 80 | uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 |
77 | 81 | with: |
78 | 82 | sarif_file: scorecard-results.sarif |
79 | 83 |
|
80 | 84 | - if: github.event.inputs.debug == true || runner.debug == true |
81 | 85 | name: Upload results as artifacts to the workflow Summary page |
82 | | - # yamllint disable rule:line-length |
83 | 86 | uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 |
84 | 87 | with: |
85 | 88 | name: Scorecard SARIF file |
|
0 commit comments