.github/workflows/scorecard.yml

   1 name: Scorecard supply-chain security
   2 on:
   3   # For Branch-Protection check. Only the default branch is supported. See
   4   # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
   5   branch_protection_rule:
   6   # To guarantee Maintained check is occasionally updated. See
   7   # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
   8   schedule:
   9     - cron: '36 17 * * 5'
  10   push:
  11     branches: [ "main" ]
  12
  13 # Declare default permissions as read only.
  14 permissions: read-all
  15
  16 jobs:
  17   analysis:
  18     name: Scorecard analysis
  19     runs-on: ubuntu-latest
  20     permissions:
  21       security-events: write # to upload the results to code-scanning dashboard
  22       id-token: write # to publish results and get a badge
  23
  24     steps:
  25       - name: "Checkout code"
  26         uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
  27         with:
  28           persist-credentials: false
  29
  30       - name: "Run analysis"
  31         uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
  32         with:
  33           results_file: results.sarif
  34           results_format: sarif
  35           # To enable Branch-Protection uncomment the `repo_token` line below
  36           # To create the Fine-grained PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-fine-grained-pat-optional.
  37           # repo_token: ${{ secrets.SCORECARD_TOKEN }}
  38           publish_results: true # allows the repo to include the Scorecard badge
  39
  40       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
  41       # format to the repository Actions tab.
  42       - name: "Upload artifact"
  43         uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba # v4.3.2
  44         with:
  45           name: SARIF file
  46           path: results.sarif
  47           retention-days: 5
  48
  49       # Upload the results to GitHub's code scanning dashboard.
  50       - name: "Upload to code-scanning"
  51         uses: github/codeql-action/upload-sarif@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
  52         with:
  53           sarif_file: results.sarif