scorecards-analysis.yaml

# Run Scorecard for this repository to further check and harden software and process.

name: Scorecards supply-chain security
on:
  # Only the default branch is supported.
  branch_protection_rule:
  schedule:
  - cron: 27 20 * * 1
  push:
    branches: [main]

# Declare default permissions as read only.
permissions: read-all

jobs:
  analysis:
    name: Scorecards analysis
    runs-on: ubuntu-latest
    permissions:
      # Needed to upload the results to code-scanning dashboard.
      security-events: write
      actions: read
      contents: read
      # Needed to access OIDC token.
      id-token: write
    steps:

    - name: Harden Runner
      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
        disable-sudo: true

    - name: Check out repository
      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
      with:
        persist-credentials: false

    - name: Run analysis
      uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
      with:
        results_file: results.sarif
        results_format: sarif
        # Read-only PAT token. To create it,
        # follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat-optional.
        repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}
        # Publish the results to enable scorecard badges. For more details, see
        # https://github.com/ossf/scorecard-action#publishing-results.
        # For private repositories, `publish_results` will automatically be set to `false`,
        # regardless of the value entered here.
        publish_results: true

    # Upload the results as artifacts (optional).
    - name: Upload artifact
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        name: SARIF file
        path: results.sarif

    # Upload the results to GitHub's code scanning dashboard.
    - name: Upload to code-scanning
      uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
      with:
        sarif_file: results.sarif