name: Scorecards analysis

on:

branch_protection_rule:

schedule:

- cron: '21 6 * * 1'

push:

branches: [ develop ]

workflow_dispatch:

permissions: {}

jobs:

analysis:

name: Scorecards analysis

runs-on: ubuntu-latest

permissions:

# NOTE: If you add security critical permissions, start pinning used actions

security-events: write # for uploading to code-scanning dashboard

id-token: write # for publishing results in scorecard public dataset

actions: read

contents: read

steps:

- name: "Checkout code"

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

with:

persist-credentials: false

- name: "Run analysis"

uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3

with:

results_file: results.sarif

# sarif format required by upload-sarif action

results_format: sarif

# "repo_token" not set because personal access tokens are dangerous.

# This means Branch-Protection check will not have correct results.

publish_results: true

- name: "Upload to code-scanning dashboard"

uses: github/codeql-action/upload-sarif@v4 # zizmor: ignore[unpinned-uses]

with:

sarif_file: results.sarif