49 lines
1.6 KiB
YAML
49 lines
1.6 KiB
YAML
name: OpenSSF Scorecard
|
|
|
|
# Scores the repo's security posture (branch protection, pinned deps, token
|
|
# permissions, etc.) and publishes to the OpenSSF public API so a badge can be
|
|
# shown (badge is added in Plan E). REQUIRES the canonical repo to be PUBLIC —
|
|
# see the maintainer checklist in docs/systems/security-scanning.md.
|
|
|
|
on:
|
|
branch_protection_rule:
|
|
schedule:
|
|
- cron: '18 4 * * 2' # weekly Tuesday 04:18 UTC
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions: read-all
|
|
|
|
jobs:
|
|
analysis:
|
|
name: Scorecard analysis
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
security-events: write # upload SARIF
|
|
id-token: write # publish_results OIDC attestation
|
|
steps:
|
|
- name: Harden the runner
|
|
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
|
|
with:
|
|
egress-policy: audit
|
|
- name: Checkout
|
|
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Run Scorecard
|
|
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
|
|
with:
|
|
results_file: results.sarif
|
|
results_format: sarif
|
|
publish_results: true
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: SARIF file
|
|
path: results.sarif
|
|
retention-days: 5
|
|
- name: Upload SARIF to code scanning
|
|
uses: github/codeql-action/upload-sarif@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0
|
|
with:
|
|
sarif_file: results.sarif
|