scorecard.yml

# SPDX-License-Identifier: MPL-2.0
name: OSSF Scorecard

on:
  push:
    branches: [main, master]
  schedule:
    - cron: '0 4 * * *'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
permissions:
  contents: read

jobs:
  scorecard:
    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@09e7023d24682621bea4e11965a1ef5e87d86c3b
    # Reusable called-workflow permissions are CAPPED by the caller's grants;
    # without security-events: write here the scorecard SARIF upload fails with
    # startup_failure (hypatia WF018). id-token: write enables OIDC publish.
    permissions:
      contents: read
      security-events: write
      id-token: write
    timeout-minutes: 15