Scorecard #37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Scorecard | |
| # OpenSSF Scorecard — automated security-posture analysis. Scores the repo | |
| # against the OpenSSF supply-chain best practices (branch protection, pinned | |
| # dependencies, token permissions, dangerous workflow patterns, etc.). Results | |
| # are uploaded to Security > Code scanning and published to the public | |
| # Scorecard API so the README badge stays live. | |
| on: | |
| # Re-run when branch protection settings change, since several checks score them. | |
| branch_protection_rule: | |
| # Weekly refresh to pick up newly added checks and reflect the current state. | |
| schedule: | |
| - cron: "30 5 * * 1" | |
| # Score the default branch on every push so the badge tracks master. | |
| push: | |
| branches: [master] | |
| workflow_dispatch: | |
| # Least privilege at the top level; the job below opts into exactly what it needs. | |
| permissions: read-all | |
| concurrency: | |
| group: scorecard-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| # Upload the SARIF results to the code-scanning dashboard. | |
| security-events: write | |
| # Publish results to the public OpenSSF Scorecard API (OIDC, keyless). | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| # Publish so the public Scorecard API / README badge reflect the score. | |
| publish_results: true | |
| # Keep the raw SARIF as an artifact for debugging a run after the fact. | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: scorecard-results | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: Upload SARIF to code scanning | |
| uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 | |
| with: | |
| sarif_file: results.sarif |