scorecard.yml

name: Scorecard

on:
  # Re-run when branch protection rules change, since several checks
  # (Branch-Protection, Code-Review) score that configuration directly.
  branch_protection_rule:
  push:
    branches: [main]
  schedule:
    - cron: "41 7 * * 2"

# Declare default permissions as read-only.
permissions: read-all

concurrency:
  group: scorecard-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

# All `uses:` below are pinned to commit SHAs to eliminate supply-chain
# risk from action-release spoofing. Bump via Dependabot (see
# .github/dependabot.yml), which rewrites the SHA + version comment.
jobs:
  analysis:
    name: analysis
    runs-on: ubuntu-latest
    permissions:
      # Needed to upload the SARIF results to the code-scanning dashboard.
      security-events: write
      # Needed to publish results and obtain a badge (OIDC token).
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Run analysis
        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
        with:
          results_file: results.sarif
          results_format: sarif
          # Publish results to the OpenSSF REST API. Required for the
          # public badge and the scorecard.dev viewer; only takes effect
          # on default-branch runs.
          publish_results: true

      # Retain the SARIF for download from the Actions run (optional).
      - name: Upload artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: SARIF file
          path: results.sarif
          retention-days: 5

      - name: Upload to code-scanning
        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          sarif_file: results.sarif