FilesExpand file tree

main

/

scorecards.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

52 lines (45 loc) · 1.25 KB

main

/

scorecards.yml

Copy path

Top

File metadata and controls

• Code
• Blame

52 lines (45 loc) · 1.25 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

name: Scorecard supply-chain security

on:

branch_protection_rule:

schedule:

- cron: '20 7 * * 2'

push:

branches: ["main"]

workflow_dispatch:

permissions: read-all

jobs:

analysis:

name: Scorecard analysis

runs-on: ubuntu-latest

permissions:

# Needed to upload the results to code-scanning dashboard.

security-events: write

# Needed to publish results and get a badge (see publish_results below).

id-token: write

contents: read

actions: read

steps:

- name: Harden Runner

uses: step-security/harden-runner@v2.15.1

with:

egress-policy: audit

- name: "Checkout code"

uses: actions/checkout@v6.0.2

with:

persist-credentials: false

- name: "Run analysis"

uses: ossf/scorecard-action@v2.4.3

with:

results_file: results.sarif

results_format: sarif

publish_results: true

- name: "Upload artifact"

uses: actions/upload-artifact@v7.0.0

with:

name: SARIF file

path: results.sarif

retention-days: 5

- name: "Upload to code-scanning"

uses: github/codeql-action/upload-sarif@v4.31.2

with:

sarif_file: results.sarif