scorecard.yml

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by separate terms of service, privacy
# policy, and support documentation.

name: Scorecard supply-chain security
on:
  # For Branch-Protection check. Only the default branch is supported. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
  branch_protection_rule:
  # To guarantee Maintained check is occasionally updated. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
  schedule:
    - cron: '41 8 * * 4'
  push:
    branches:
      - main

# Declare default permissions as read only.
permissions: read-all

jobs:
  analysis:
    name: Scorecard analysis
    runs-on: ubuntu-latest
    permissions:
      # Needed to upload the results to code-scanning dashboard.
      security-events: write
      # Needed to publish results and get a badge (see publish_results below).
      id-token: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            api.osv.dev:443
            api.scorecard.dev:443
            api.securityscorecards.dev:443
            fulcio.sigstore.dev:443
            github.com:443
            index.docker.io:443
            oss-fuzz-build-logs.storage.googleapis.com:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443
            www.bestpractices.dev:443

      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
        with:
          persist-credentials: false

      - name: Run analysis
        uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534
        with:
          results_file: results.sarif
          results_format: sarif
          # This job step requires a personal access token named `OPENSSF_SCORECARD_TOKEN` with the following privileges:
          # - Administration: Read-Only
          # - Metadata: Read-Only
          # - Webhooks: Read-Only
          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
          repo_token: ${{ secrets.OPENSSF_SCORECARD_TOKEN }}

          # Public repositories:
          #   - Publish results to OpenSSF REST API for easy access by consumers
          #   - Allows the repository to include the Scorecard badge.
          #   - See https://github.com/ossf/scorecard-action#publishing-results.
          publish_results: true

      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: Upload artifact
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
        with:
          name: SARIF file
          path: results.sarif
          retention-days: 5

      # Upload the results to GitHub's code scanning dashboard.
      - name: Upload to code-scanning
        uses: github/codeql-action/upload-sarif@23acc5c183826b7a8a97bce3cecc52db901f8251  # 3.25.10
        with:
          sarif_file: results.sarif