scorecard.yml

# OpenSSF Scorecard - Security health metrics for open source projects
# https://github.com/ossf/scorecard
# Results appear in the GitHub Security tab under Code scanning alerts

name: OpenSSF Scorecard

on:
  push:
    branches:
      - main
  schedule:
    # Weekly scan: Sundays at 03:00 UTC
    - cron: "0 3 * * 0"
  # Re-scan immediately after releases so Scorecard detects signing artifacts
  workflow_run:
    workflows:
      - CI
    types:
      - completed
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  scorecard:
    name: Scorecard analysis
    # Skip workflow_run triggers from failed CI runs
    if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      id-token: write
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Run Scorecard
        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
        with:
          results_file: results.sarif
          results_format: sarif
          publish_results: true

      - name: Upload SARIF to Security tab
        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
        continue-on-error: true
        with:
          sarif_file: results.sarif
          category: openssf-scorecard

      - name: Upload Scorecard results
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: scorecard-results
          path: results.sarif
          retention-days: 90