Scorecard supply-chain security #72
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OpenSSF Scorecard — supply-chain security analysis. | |
| # | |
| # Runs on push to main, on branch-protection-rule changes, and weekly so the | |
| # score stays current as the repo evolves. Results are uploaded to GitHub's | |
| # code-scanning surface (visible in Security tab) and published to the public | |
| # OpenSSF metric API at api.scorecard.dev so the badge auto-updates. | |
| # | |
| # Especially important for THIS repo: it hosts reusable workflows | |
| # (e.g. .github/workflows/ci-java.yml) that other org repos call into via | |
| # uses: runcycles/.github/.github/workflows/ci-java.yml@main | |
| # A compromise here executes inside every consuming repo's CI with their | |
| # secrets — this is the highest-blast-radius repo in the org. | |
| # | |
| # Setup notes: | |
| # - publish_results: true requires the repo to be public (it is). | |
| # - id-token: write is required to mint the OIDC token used for publishing. | |
| # - Workflow MUST live on the default branch for results to publish. | |
| name: Scorecard supply-chain security | |
| on: | |
| branch_protection_rule: | |
| schedule: | |
| - cron: '0 6 * * 1' # Monday 06:00 UTC — weekly refresh | |
| push: | |
| branches: [main] | |
| permissions: read-all | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # Upload SARIF to code-scanning | |
| id-token: write # Mint OIDC token for publish to api.scorecard.dev | |
| contents: read | |
| actions: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: SARIF file | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: Upload to code-scanning | |
| uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 | |
| with: | |
| sarif_file: results.sarif |