cli/.github/workflows/scorecard.yml at 105bccb2e299f10680a345b4b22a49144123e7bd · dependabot/cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
name: Scorecard analysis

on:
  push:
    branches:
      - main
  schedule:
    - cron: '22 17 * * 1' # https://crontab.guru/#22_17_*_*_1
  workflow_dispatch:

permissions:
  actions: read
  checks: read
  contents: read
  issues: read
  pull-requests: read
  statuses: read
  # Needed for SARIF upload
  security-events: write

jobs:
  analysis:
    name: Scorecard analysis
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
        with:
          results_file: results.sarif
          results_format: sarif

      - uses: github/codeql-action/upload-sarif@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12
        with:
          sarif_file: results.sarif