@@ -35,46 +35,46 @@ jobs:
3535 # actions: read
3636
3737 steps :
38- - name : " Checkout code"
39- uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
40- with :
41- persist-credentials : false
38+ - name : " Checkout code"
39+ uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
40+ with :
41+ persist-credentials : false
4242
43- - name : " Run analysis"
44- uses : ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
45- with :
46- results_file : results.sarif
47- results_format : sarif
48- # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
49- # - you want to enable the Branch-Protection check on a *public* repository, or
50- # - you are installing Scorecard on a *private* repository
51- # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
52- # repo_token: ${{ secrets.SCORECARD_TOKEN }}
43+ - name : " Run analysis"
44+ uses : ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
45+ with :
46+ results_file : results.sarif
47+ results_format : sarif
48+ # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
49+ # - you want to enable the Branch-Protection check on a *public* repository, or
50+ # - you are installing Scorecard on a *private* repository
51+ # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
52+ # repo_token: ${{ secrets.SCORECARD_TOKEN }}
5353
54- # Public repositories:
55- # - Publish results to OpenSSF REST API for easy access by consumers
56- # - Allows the repository to include the Scorecard badge.
57- # - See https://github.com/ossf/scorecard-action#publishing-results.
58- # For private repositories:
59- # - `publish_results` will always be set to `false`, regardless
60- # of the value entered here.
61- publish_results : true
54+ # Public repositories:
55+ # - Publish results to OpenSSF REST API for easy access by consumers
56+ # - Allows the repository to include the Scorecard badge.
57+ # - See https://github.com/ossf/scorecard-action#publishing-results.
58+ # For private repositories:
59+ # - `publish_results` will always be set to `false`, regardless
60+ # of the value entered here.
61+ publish_results : true
6262
63- # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
64- # file_mode: git
63+ # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
64+ # file_mode: git
6565
66- # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
67- # format to the repository Actions tab.
68- - name : " Upload artifact"
69- uses : actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
70- with :
71- name : SARIF file
72- path : results.sarif
73- retention-days : 5
66+ # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
67+ # format to the repository Actions tab.
68+ - name : " Upload artifact"
69+ uses : actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
70+ with :
71+ name : SARIF file
72+ path : results.sarif
73+ retention-days : 5
7474
75- # Upload the results to GitHub's code scanning dashboard (optional).
76- # Commenting out will disable upload of results to your repo's Code Scanning dashboard
77- - name : " Upload to code-scanning"
78- uses : github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
79- with :
80- sarif_file : results.sarif
75+ # Upload the results to GitHub's code scanning dashboard (optional).
76+ # Commenting out will disable upload of results to your repo's Code Scanning dashboard
77+ - name : " Upload to code-scanning"
78+ uses : github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
79+ with :
80+ sarif_file : results.sarif
0 commit comments