feat(query): dogfood loop — FileStore persistence + token-budgeted co… #44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | ||
| name: Scorecards supply-chain security | ||
| on: | ||
| branch_protection_rule: | ||
| schedule: | ||
| - cron: '23 4 * * 1' | ||
| push: | ||
| branches: [main] | ||
| # Workflow-level permissions are read-only. The job that calls the reusable | ||
| # upgrades to the writes `ossf/scorecard-action` requires. Job-level | ||
| # permissions REPLACE workflow-level for that job, so `contents: read` here | ||
| # plus the writes below yields the correct effective set and avoids the | ||
| # `read-all` startup_failure seen estate-wide. Matches the canonical caller in | ||
| # hyperpolymath/standards/.github/workflows/scorecard-reusable.yml. | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| analysis: | ||
|
Check failure on line 21 in .github/workflows/scorecard.yml
|
||
| permissions: | ||
| security-events: write | ||
| id-token: write | ||
| uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e | ||
| secrets: inherit | ||
