scorecard.yml

# SPDX-License-Identifier: MPL-2.0
name: Scorecards supply-chain security

on:
  branch_protection_rule:
  schedule:
    - cron: '23 4 * * 1'
  push:
    branches: [main]

# Workflow-level permissions are read-only. The job that calls the reusable
# upgrades to the writes `ossf/scorecard-action` requires. Job-level
# permissions REPLACE workflow-level for that job, so `contents: read` here
# plus the writes below yields the correct effective set and avoids the
# `read-all` startup_failure seen estate-wide. Matches the canonical caller in
# hyperpolymath/standards/.github/workflows/scorecard-reusable.yml.
permissions:
  contents: read

jobs:
  analysis:
    permissions:
      security-events: write
      id-token: write
    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
    secrets: inherit