scorecard.yml

# SPDX-License-Identifier: MPL-2.0
name: Scorecards supply-chain security

on:
  branch_protection_rule:
  schedule:
    - cron: '23 4 * * 1'
  push:
    branches: [main]

# The reusable's scorecard job declares security-events:write + id-token:write;
# a called workflow's job permissions must be a SUBSET of the caller's grant
# (callee ⊆ caller) — `read-all` grants no writes, so the run startup-failed at
# plan time with zero jobs.
permissions:
  contents: read
  security-events: write
  id-token: write

jobs:
  analysis:
    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
    secrets: inherit