scorecard.yml

# SPDX-License-Identifier: MPL-2.0
name: Scorecards supply-chain security

on:
  branch_protection_rule:
  schedule:
    - cron: '23 4 * * 1'
  push:
    branches: [main]

permissions: read-all

jobs:
  analysis:
    # Explicit least-privilege permissions for the reusable Scorecard call:
    # contents:read to check out, security-events:write to upload the SARIF,
    # id-token:write to publish results to the OpenSSF API. Matches the scopes
    # declared by scorecard-reusable.yml@5a93d9d5.
    # (Hypatia workflow_audit: scorecard_wrapper_missing_job_permissions)
    permissions:
      contents: read
      security-events: write
      id-token: write
    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910
    secrets: inherit