chore(deps): update ferrlabs/.github digest to 1a21d23 (#1201) #749
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OSSF Scorecard | |
| on: | |
| branch_protection_rule: | |
| schedule: | |
| - cron: '0 3 * * 1' # weekly, Monday 03:00 UTC | |
| push: | |
| branches: [main] | |
| # Declare default permissions as read only at the workflow level. | |
| permissions: read-all | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Required for publishing results to the GitHub code scanning dashboard. | |
| security-events: write | |
| # Required for Scorecard workflow to fetch repository metadata. | |
| id-token: write | |
| contents: read | |
| actions: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| # publish_results: true publishes to scorecard.dev which backs the | |
| # public badge URL used in the README. | |
| publish_results: true | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: SARIF results | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: Upload to code scanning | |
| uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 | |
| with: | |
| sarif_file: results.sarif |