Merge pull request #41 from dcondrey/docs/repository-standards-20260901 #53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OpenSSF Scorecard: grades the repo's supply-chain security posture and publishes results | |
| # (enabling the public Scorecard badge). Runs on branch-protection changes, weekly, and on push. | |
| name: Scorecard | |
| on: | |
| branch_protection_rule: | |
| schedule: | |
| - cron: '27 4 * * 1' | |
| push: | |
| branches: [master] | |
| permissions: | |
| contents: read | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # upload SARIF results to code scanning | |
| id-token: write # publish results to the OpenSSF Scorecard API (enables the badge) | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - name: Upload SARIF to code scanning | |
| uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | |
| with: | |
| sarif_file: results.sarif |