name: OpenSSF Scorecard

on:

branch_protection_rule:

schedule:

- cron: "27 7 * * 3" # A random time to run weekly

push:

branches: ["main"]

permissions: read-all

jobs:

analysis:

name: Scorecard analysis

runs-on: ubuntu-latest

permissions:

# Needed to upload the results to code-scanning dashboard.

security-events: write

# Needed to publish results and get a badge (see publish_results below).

id-token: write

steps:

- name: Harden Runner

uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1

with:

egress-policy: audit

- name: "Checkout code"

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

with:

persist-credentials: false

- name: "Run analysis"

uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3

with:

results_file: results.sarif

results_format: sarif

repo_token: ${{ secrets.GITHUB_TOKEN }}

publish_results: true

# Upload the results as artifacts.

- name: "Upload artifact"

uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0

with:

name: SARIF file

path: results.sarif

retention-days: 5

# Upload the results to GitHub's code scanning dashboard.

- name: "Upload to code-scanning"

uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v3.29.5

with:

sarif_file: results.sarif