scorecard.yml

# yamllint disable rule:line-length
---
name: OpenSSF Scorecard

on:
  schedule:
    - cron: 18 2 * * 1
  push:
    branches:
      - main
  branch_protection_rule: {}

permissions:
  actions: read
  contents: read
  id-token: write
  security-events: write

concurrency:
  group: scorecard
  cancel-in-progress: true

jobs:
  analysis:
    if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Clone the repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - name: Perform analysis
        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
        with:
          publish_results: true
          results_file: results.sarif
          results_format: sarif
      - name: Upload to code scanning
        uses: github/codeql-action/upload-sarif@86b04fb0e47484f7282357688f21d5d0e32175fe # v3.29.0
        with:
          sarif_file: results.sarif