FilesExpand file tree

develop

/

ossf_scorecard.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

101 lines (86 loc) · 3.51 KB

develop

/

ossf_scorecard.yml

Copy path

Top

File metadata and controls

• Code
• Blame

101 lines (86 loc) · 3.51 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

#/

# @license Apache-2.0

#

# Copyright (c) 2023 The Stdlib Authors.

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

# http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

#/

# Workflow name:

name: ossf_scorecard

# Workflow triggers:

on:

# For Branch-Protection check. Only the default branch is supported. See

# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection

branch_protection_rule:

# To guarantee Maintained check is occasionally updated. See

# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained

schedule:

- cron: '24 9 * * 0'

# Allow the workflow to be manually run:

workflow_dispatch:

# Declare default global permissions as read only.

permissions: read-all

# Workflow jobs:

jobs:

# Define a job for running the scorecard analysis:

analysis:

# Define a display name:

name: Scorecard analysis

# Ensure the job does not run on forks:

if: github.repository == 'stdlib-js/stdlib'

# Define the type of virtual host machine:

runs-on: ubuntu-latest

# Workflow permissions:

permissions:

# Needed to upload the results to code-scanning dashboard.

security-events: write

# Needed to publish results and get a badge (see publish_results below).

id-token: write

# Define the sequence of job steps...

steps:

# Checkout the repository:

- name: 'Checkout repository'

# Pin action to full length commit SHA

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

timeout-minutes: 10

with:

persist-credentials: false

- name: "Run analysis"

# Pin action to full length commit SHA

uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3

with:

results_file: results.sarif

results_format: sarif

# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:

# - you want to enable the Branch-Protection check on a *public* repository, or

# - you are installing Scorecard on a *private* repository

# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.

# repo_token: ${{ secrets.SCORECARD_TOKEN }}

# Publishes results to OpenSSF REST API for easy access by consumers

# Allows the repository to include the Scorecard badge.

# See: https://github.com/ossf/scorecard-action#publishing-results.

publish_results: true

# Upload the results as artifacts:

- name: "Upload artifact"

# Pin action to full length commit SHA

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

with:

name: SARIF file

path: results.sarif

retention-days: 5

# Upload the results to GitHub's code scanning dashboard:

- name: "Upload to code-scanning"

# Pin action to full length commit SHA

uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4

with:

sarif_file: results.sarif