1# This workflow uses actions that are not certified by GitHub. They are provided 2# by a third-party and are governed by separate terms of service, privacy 3# policy, and support documentation. 4 5name: Scorecard supply-chain security 6on: 7 # For Branch-Protection check. Only the default branch is supported. See 8 # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection 9 branch_protection_rule: 10 # To guarantee Maintained check is occasionally updated. See 11 # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained 12 schedule: 13 - cron: '23 22 * * 3' 14 push: 15 branches: [ "dev" ] 16 17# Declare default permissions as read only. 18permissions: read-all 19 20jobs: 21 analysis: 22 name: Scorecard analysis 23 runs-on: ubuntu-latest 24 permissions: 25 # Needed to upload the results to code-scanning dashboard. 26 security-events: write 27 # Needed to publish results and get a badge (see publish_results below). 28 id-token: write 29 30 steps: 31 - name: "Checkout code" 32 uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 33 with: 34 persist-credentials: false 35 36 - name: "Run analysis" 37 uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3 38 with: 39 results_file: results.sarif 40 results_format: sarif 41 # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: 42 # you want to enable the Branch-Protection check on a *public* repository 43 # To create the PAT, follow the steps in 44 # https://github.com/ossf/scorecard-action#authentication-with-fine-grained-pat-optional 45 # repo_token: ${{ secrets.SCORECARD_TOKEN }} 46 47 # - Publish results to OpenSSF REST API for easy access by consumers 48 # - Allows the repository to include the Scorecard badge. 49 # - See https://github.com/ossf/scorecard-action#publishing-results. 50 publish_results: true 51 52 # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF 53 # format to the repository Actions tab. 54 - name: "Upload artifact" 55 uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4 56 with: 57 name: SARIF file 58 path: results.sarif 59 retention-days: 5 60 61 # Upload the results to GitHub's code scanning dashboard. 62 - name: "Upload to code-scanning" 63 uses: github/codeql-action/upload-sarif@4fa2a7953630fd2f3fb380f21be14ede0169dd4f # v3.25.12 64 with: 65 sarif_file: results.sarif 66