ci: add OpenSSF Scorecard workflow (publish_results on default branch)

2026-10-07 18:13:10 +00:00 · 2026-09-21 16:39:26 -07:00
parent 11c869f8e9
commit b69002694f
1 changed files with 27 additions and 0 deletions
@@ -0,0 +1,27 @@
 name: Scorecard
 on:
  branch_protection_rule:
  schedule:
    - cron: '22 9 * * 2'
  push:
    branches: ["dev"]
 permissions: read-all
 jobs:
  analysis:
    name: Scorecard analysis
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: ossf/scorecard-action@v2.4.0
        with:
          results_file: results.sarif
          results_format: sarif
          publish_results: true
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif