Scorecard supply-chain security #125
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Scorecard supply-chain security | |
| on: | |
| branch_protection_rule: | |
| schedule: | |
| - cron: "20 7 * * 1" # Mondays 07:20 UTC | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| # Least-privilege by default; the job opts into what it needs. | |
| permissions: read-all | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| # Scorecard's SARIF upload + OpenSSF publish only work on public repos. | |
| # `github.event.repository` is absent on `schedule`, so scheduled runs also | |
| # skip until the repo is public — re-check this gate after going public. | |
| if: ${{ github.event.repository.visibility == 'public' }} | |
| permissions: | |
| security-events: write # upload SARIF to code scanning | |
| id-token: write # publish results to the OpenSSF API (badge) | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| # Publishes to the public Scorecard API so the README badge works. | |
| # Requires a public repository. | |
| publish_results: true | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: SARIF file | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: Upload to code scanning | |
| uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4 | |
| with: | |
| sarif_file: results.sarif |