feat(ci): attest build provenance (#53) #181

	# SPDX-License-Identifier: MPL-2.0
	name: Scorecards supply-chain security

	on:
	branch_protection_rule:
	schedule:
	- cron: '23 4 * * 1'
	push:
	branches: [main]

	permissions: read-all

	jobs:
	analysis:
	# Explicit least-privilege permissions for the reusable Scorecard call:
	# contents:read to check out, security-events:write to upload the SARIF,
	# id-token:write to publish results to the OpenSSF API — exactly the
	# scopes the pinned reusable Scorecard workflow declares.
	# (Hypatia workflow_audit: scorecard_wrapper_missing_job_permissions)
	# NOTE: do not write the reusable's "<name>.yml@<sha>" string in a comment
	# here — the estate staleness check greps every line for that token and a
	# second match would break its single-pin SHA comparison.
	permissions:
	contents: read
	security-events: write
	id-token: write
	uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
	secrets: inherit

Provide feedback