FilesExpand file tree

main

/

scorecard-reusable.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

131 lines (120 loc) · 4.93 KB

main

/

scorecard-reusable.yml

Copy path

Top

File metadata and controls

• Code
• Blame

131 lines (120 loc) · 4.93 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

# This workflow uses actions that are not certified by GitHub. They are provided

# by a third-party and are governed by separate terms of service, privacy

# policy, and support documentation.

name: Scorecard supply-chain security

on:

workflow_call:

inputs:

results-file:

description: "Path to the SARIF results file"

required: false

type: string

default: "results.sarif"

results-format:

description: "Results format (sarif, json, csv, etc.)"

required: false

type: string

default: "sarif"

publish-results:

description: "Publish results to OpenSSF REST API for public repositories"

required: false

type: boolean

default: true

repo-token:

description:

"Fine-grained PAT token for Branch-Protection check on public repos or private repo

installation"

required: false

type: string

default: ""

file-mode:

description: "File mode for .gitattributes with export-ignore (e.g., git)"

required: false

type: string

default: ""

retention-days:

description: "Artifact retention days"

required: false

type: number

default: 5

upload-artifact:

description: "Upload results as artifact"

required: false

type: boolean

default: true

upload-code-scanning:

description: "Upload results to GitHub code scanning dashboard"

required: false

type: boolean

default: true

# Declare default permissions as read only.

permissions:

contents: read

issues: read

pull-requests: read

checks: read

jobs:

analysis:

name: Scorecard analysis

runs-on: ubuntu-latest

# `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.

if:

github.event.repository.default_branch == github.ref_name || github.event_name ==

'pull_request'

permissions:

# Needed for Scorecard to read repository contents.

contents: read

# Needed for Scorecard to query issues and pull requests.

issues: read

pull-requests: read

# Needed for Scorecard to check configured SAST tools.

checks: read

# Needed to upload the results to code-scanning dashboard.

security-events: write

# Needed to publish results and get a badge (see publish_results below).

id-token: write

steps:

- name: Harden the runner (Audit all outbound calls)

uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2

with:

egress-policy: audit

- name: "Checkout code"

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

persist-credentials: false

- name: "Run analysis"

uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0

with:

results_file: ${{ inputs.results-file }}

results_format: ${{ inputs.results-format }}

# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:

# - you want to enable the Branch-Protection check on a *public* repository, or

# - you are installing Scorecard on a *private* repository

# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.

repo_token: ${{ inputs.repo-token }}

# Public repositories:

# - Publish results to OpenSSF REST API for easy access by consumers

# - Allows the repository to include the Scorecard badge.

# - See https://github.com/ossf/scorecard-action#publishing-results.

# For private repositories:

# - `publish_results` will always be set to `false`, regardless

# of the value entered here.

publish_results: ${{ inputs.publish-results }}

# (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore

file_mode: ${{ inputs.file-mode }}

# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF

# format to the repository Actions tab.

- name: "Upload artifact"

if: ${{ inputs.upload-artifact }}

uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2

with:

name: SARIF file

path: ${{ inputs.results-file }}

retention-days: ${{ inputs.retention-days }}

# Upload the results to GitHub's code scanning dashboard (optional).

# Commenting out will disable upload of results to your repo's Code Scanning dashboard

- name: "Upload to code-scanning"

if: ${{ inputs.upload-code-scanning }}

uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1

with:

sarif_file: ${{ inputs.results-file }}