Scorecard supply-chain security #307
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Scorecard supply-chain security | |
| # OpenSSF Scorecard: an automated, auditable read on the repo's supply-chain | |
| # posture (pinned deps, branch protection, signed/attested releases, SAST, | |
| # token permissions). Runs weekly, on push to main, and on manual dispatch, and | |
| # publishes the result so the README badge and https://scorecard.dev/ stay current. | |
| # Manual dispatch lets maintainers refresh the public result after repository | |
| # controls or release evidence change instead of waiting for the weekly run. | |
| on: | |
| workflow_dispatch: | |
| branch_protection_rule: | |
| schedule: | |
| - cron: "20 7 * * 1" | |
| push: | |
| branches: ["main"] | |
| # Top-level least-privilege; the analysis job opts into exactly what it needs. | |
| permissions: | |
| contents: read | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| # Needed to upload the SARIF results to the code-scanning dashboard. | |
| security-events: write | |
| # Needed for the OIDC token that publishes results to the public API. | |
| id-token: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: SARIF file | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: Upload to code-scanning | |
| uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 | |
| with: | |
| sarif_file: results.sarif |