FilesExpand file tree

main

/

scorecards.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

62 lines (55 loc) · 2.35 KB

main

/

scorecards.yml

Copy path

Top

File metadata and controls

• Code
• Blame

62 lines (55 loc) · 2.35 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

name: Scorecards supply-chain security

on:

# Only the default branch is supported.

branch_protection_rule:

schedule:

- cron: '36 4 * * 3'

push:

branches: [ "main" ]

# Declare default permissions as read only.

permissions: read-all

jobs:

analysis:

name: Scorecards analysis

runs-on: ubuntu-latest

permissions:

# Needed to upload the results to code-scanning dashboard.

security-events: write

# Used to receive a badge. (Upcoming feature)

id-token: write

# Needs for private repositories.

contents: read

actions: read

steps:

- name: "Checkout code"

uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0

with:

persist-credentials: false

- name: "Run analysis"

uses: ossf/scorecard-action@3e15ea8318eee9b333819ec77a36aca8d39df13e # tag=v1.1.1

with:

results_file: results.sarif

results_format: sarif

# (Optional) Read-only PAT token. Uncomment the `repo_token` line below if:

# - you want to enable the Branch-Protection check on a *public* repository, or

# - you are installing Scorecards on a *private* repository

# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.

# repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}

# Publish the results for public repositories to enable scorecard badges. For more details, see

# https://github.com/ossf/scorecard-action#publishing-results.

# For private repositories, `publish_results` will automatically be set to `false`, regardless

# of the value entered here.

publish_results: true

# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF

# format to the repository Actions tab.

- name: "Upload artifact"

uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # tag=v3.0.0

with:

name: SARIF file

path: results.sarif

retention-days: 5

# Upload the results to GitHub's code scanning dashboard.

- name: "Upload to code-scanning"

uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26

with:

sarif_file: results.sarif