scorecards.yml

name: Scorecards supply-chain security
on:
    # For Branch-Protection check. Only the default branch is supported. See
    # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
    branch_protection_rule:
    # To guarantee Maintained check is occasionally updated. See
    # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
    schedule:
        - cron: '23 2 * * 5'
    push:
        branches: ['master']

# Declare default permissions as read only.
permissions: read-all

jobs:
    analysis:
        name: Scorecards analysis
        runs-on: ubuntu-latest
        permissions:
            # Needed to upload the results to code-scanning dashboard.
            security-events: write
            # Needed to publish results and get a badge (see publish_results below).
            id-token: write
            # Uncomment the permissions below if installing in a private repository.
            # contents: read
            # actions: read

        steps:
            - name: 'Checkout code'
              uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
              with:
                  persist-credentials: false

            - name: 'Run analysis'
              uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
              with:
                  results_file: results.sarif
                  results_format: sarif
                  # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
                  # - you want to enable the Branch-Protection check on a *public* repository, or
                  # - you are installing Scorecards on a *private* repository
                  # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
                  # repo_token: ${{ secrets.SCORECARD_TOKEN }}

                  # Public repositories:
                  #   - Publish results to OpenSSF REST API for easy access by consumers
                  #   - Allows the repository to include the Scorecard badge.
                  #   - See https://github.com/ossf/scorecard-action#publishing-results.
                  # For private repositories:
                  #   - `publish_results` will always be set to `false`, regardless
                  #     of the value entered here.
                  publish_results: true

            # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
            # format to the repository Actions tab.
            - name: 'Upload artifact'
              uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
              with:
                  name: SARIF file
                  path: results.sarif
                  retention-days: 5

            # Upload the results to GitHub's code scanning dashboard.
            - name: 'Upload to code-scanning'
              uses: github/codeql-action/upload-sarif@6a89f57882288b3d2f190cda65000eec9e9ebb7c # v2.27.0
              with:
                  sarif_file: results.sarif