fix(ci): resolve OpenSSF Scorecard workflow failures #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OpenSSF Scorecard | |
| # Automated security posture scoring against the OpenSSF Scorecard ruleset: | |
| # https://github.com/ossf/scorecard | |
| # | |
| # Score appears in the Security tab + can be embedded as a badge. | |
| # Catches regressions in: dangerous workflows, missing branch protection, | |
| # unpinned actions, weak deps, exposed secrets, missing license, etc. | |
| # | |
| # Triggers: | |
| # - branch_protection_rule (fires when branch protection config changes) | |
| # - Weekly Saturday cron (keeps the score fresh as new checks ship) | |
| # - Push to main (catches just-shipped regressions) | |
| on: | |
| branch_protection_rule: | |
| schedule: | |
| - cron: "0 13 * * 6" | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| security-events: write | |
| id-token: write | |
| actions: read | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Checkout (full history needed by Scorecard) | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| - name: Run Scorecard | |
| uses: ossf/scorecard-action@13ec8c77e8a5dae7e0a0d47bde3e3004df15d34f # v2 | |
| # Soft-fail: tolerate transient external failures (GitHub code-search | |
| # rate-limiting the OSS-Fuzz check, or upstream Sigstore/Fulcio/TUF | |
| # signing errors) rather than reddening CI for issues outside this | |
| # repo's control. Matches the gating pattern in | |
| # mizcausevic-dev/kineticgain-com-apex commit 2cc1eba. | |
| continue-on-error: true | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| # publish_results: false avoids the public Sigstore transparency-log | |
| # signing step, which is the source of the upstream "tuf: invalid | |
| # key" failures. Results still land in the SARIF upload below. | |
| publish_results: false | |
| - name: Upload SARIF (so Security tab shows findings) | |
| uses: github/codeql-action/upload-sarif@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3 | |
| with: | |
| sarif_file: results.sarif | |
| - name: Upload artifact (raw JSON downloadable from the run) | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: SARIF file | |
| path: results.sarif | |
| retention-days: 30 |