OSSF Scorecard #162
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OSSF Scorecard | |
| on: | |
| push: | |
| branches: | |
| - main | |
| # Weekly scheduled scan. | |
| schedule: | |
| - cron: "0 6 * * 1" | |
| workflow_dispatch: | |
| concurrency: | |
| group: scorecard-${{ github.ref }} | |
| cancel-in-progress: true | |
| # The Scorecard action requires ONLY read permissions at the workflow level. | |
| # Any write permission in any job of the same workflow causes the API to reject | |
| # the results. Keep this workflow dedicated to the scorecard job only. | |
| permissions: | |
| contents: read | |
| jobs: | |
| scorecard: | |
| name: OSSF Scorecard | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| # Only run on default branch to avoid token permission issues on forks. | |
| if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request' | |
| permissions: | |
| contents: read | |
| security-events: write | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run Scorecard analysis | |
| uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 | |
| with: | |
| results_file: scorecard-results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - name: Upload Scorecard SARIF | |
| uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 | |
| with: | |
| sarif_file: scorecard-results.sarif | |
| category: scorecard |