OpenSSF Scorecard #336
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OpenSSF Scorecard | |
| # The Scorecard project (https://github.com/ossf/scorecard) audits a | |
| # repository against an open checklist of supply-chain hygiene practices and | |
| # publishes a numeric score plus per-check findings to the Code Scanning | |
| # tab. The badge in README.md links to the project's public Scorecard page. | |
| on: | |
| branch_protection_rule: | |
| schedule: | |
| - cron: "23 6 * * 2" | |
| push: | |
| branches: [main] | |
| # workflow_dispatch lets a maintainer trigger a fresh Scorecard run from | |
| # the Actions tab or via `gh workflow run scorecard.yml`. Useful when | |
| # changes that affect a Scorecard check have just landed and the | |
| # maintainer wants the public score updated without waiting for the | |
| # weekly cron. | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| id-token: write | |
| contents: read | |
| actions: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| # publish_results=true publishes the score to the OpenSSF Scorecard | |
| # public registry; this is required for the README badge to resolve. | |
| publish_results: true | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: SARIF file | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: Upload to code-scanning | |
| uses: github/codeql-action/upload-sarif@0daab03d71ff584ef619d027a3fd9146679c5d84 # v3 | |
| with: | |
| sarif_file: results.sarif |