Repository navigation
🐛 fix(scorecard): pin merged workflow (#287) #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🛡️ scorecard | |
| on: | |
| branch_protection_rule: | |
| schedule: | |
| - cron: "30 7 * * 2" | |
| push: | |
| branches: ["main"] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| analysis: | |
| name: 🛡️ Scorecard analysis | |
| if: github.repository == 'pytest-dev/pytest-print' | |
| permissions: | |
| actions: read # read workflow runs for the Packaging check | |
| checks: read # read check runs for the CI-Tests and SAST checks | |
| contents: read # check out and scan the repository | |
| id-token: write # authenticate the results published to the scorecard API | |
| issues: read # read issue activity for the Maintained check | |
| pull-requests: read # read reviews for the Code-Review check | |
| security-events: write # upload the SARIF results to code scanning | |
| statuses: read # read commit statuses for the CI-Tests check | |
| uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@cfb6d637a10b70da576575790eb3c806f57cd0b5 |