feat(action): use prebuilt release binaries for commit-SHA pins (#83) #84
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: scorecard | |
| # OpenSSF Scorecard supply-chain risk assessment. Publishes results to the | |
| # public Scorecard API (so the README badge resolves) and uploads SARIF to | |
| # GitHub code scanning. | |
| # | |
| # Security note: no untrusted ${{ github.event.* }} value is interpolated into | |
| # any run: shell here, so workflow-injection does not apply to this file. | |
| on: | |
| branch_protection_rule: | |
| schedule: | |
| - cron: "41 5 * * 1" | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| permissions: | |
| security-events: write # upload SARIF to code scanning | |
| id-token: write # publish results to the Scorecard API | |
| actions: read # evaluate workflow token-permission/pinning checks | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| # Fine-grained PAT (Administration: read) so Scorecard can read | |
| # branch-protection rules, which the default GITHUB_TOKEN cannot. | |
| repo_token: ${{ secrets.SCORECARD_TOKEN }} | |
| publish_results: true | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: scorecard-results | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: Upload to code scanning | |
| uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 | |
| with: | |
| sarif_file: results.sarif |