Commit 53e8dad
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,78 @@ | |||
| 1 | + # This workflow uses actions that are not certified by GitHub. They are provided | ||
| 2 | + # by a third-party and are governed by separate terms of service, privacy | ||
| 3 | + # policy, and support documentation. | ||
| 4 | + | ||
| 5 | + name: Scorecard supply-chain security | ||
| 6 | + on: | ||
| 7 | + # For Branch-Protection check. Only the default branch is supported. See | ||
| 8 | + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection | ||
| 9 | + branch_protection_rule: | ||
| 10 | + # To guarantee Maintained check is occasionally updated. See | ||
| 11 | + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained | ||
| 12 | + schedule: | ||
| 13 | + - cron: 16 21 * * 1 | ||
| 14 | + push: | ||
| 15 | + branches: [main] | ||
| 16 | + workflow_dispatch: | ||
| 17 | + | ||
| 18 | + # Declare default permissions as read only. | ||
| 19 | + permissions: read-all | ||
| 20 | + | ||
| 21 | + jobs: | ||
| 22 | + analysis: | ||
| 23 | + name: Scorecard analysis | ||
| 24 | + runs-on: ubuntu-latest | ||
| 25 | + permissions: | ||
| 26 | + # Needed to upload the results to code-scanning dashboard. | ||
| 27 | + security-events: write | ||
| 28 | + # Needed to publish results and get a badge (see publish_results below). | ||
| 29 | + id-token: write | ||
| 30 | + # Uncomment the permissions below if installing in a private repository. | ||
| 31 | + # contents: read | ||
| 32 | + # actions: read | ||
| 33 | + | ||
| 34 | + steps: | ||
| 35 | + - name: Harden Runner | ||
| 36 | + uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v2.2.1 | ||
| 37 | + with: | ||
| 38 | + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs | ||
| 39 | + | ||
| 40 | + - name: Checkout code | ||
| 41 | + uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 | ||
| 42 | + with: | ||
| 43 | + persist-credentials: false | ||
| 44 | + | ||
| 45 | + - name: Run analysis | ||
| 46 | + uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # v2.1.2 | ||
| 47 | + with: | ||
| 48 | + results_file: results.sarif | ||
| 49 | + results_format: sarif | ||
| 50 | + # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: | ||
| 51 | + # - you want to enable the Branch-Protection check on a *public* repository, or | ||
| 52 | + # - you are installing Scorecard on a *private* repository | ||
| 53 | + # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. | ||
| 54 | + # repo_token: ${{ secrets.SCORECARD_TOKEN }} | ||
| 55 | + | ||
| 56 | + # Public repositories: | ||
| 57 | + # - Publish results to OpenSSF REST API for easy access by consumers | ||
| 58 | + # - Allows the repository to include the Scorecard badge. | ||
| 59 | + # - See https://github.com/ossf/scorecard-action#publishing-results. | ||
| 60 | + # For private repositories: | ||
| 61 | + # - `publish_results` will always be set to `false`, regardless | ||
| 62 | + # of the value entered here. | ||
| 63 | + publish_results: true | ||
| 64 | + | ||
| 65 | + # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF | ||
| 66 | + # format to the repository Actions tab. | ||
| 67 | + - name: Upload artifact | ||
| 68 | + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 | ||
| 69 | + with: | ||
| 70 | + name: SARIF file | ||
| 71 | + path: results.sarif | ||
| 72 | + retention-days: 5 | ||
| 73 | + | ||
| 74 | + # Upload the results to GitHub's code scanning dashboard. | ||
| 75 | + - name: Upload to code-scanning | ||
| 76 | + uses: github/codeql-action/upload-sarif@16964e90ba004cdf0cd845b866b5df21038b7723 # v2.2.6 | ||
| 77 | + with: | ||
| 78 | + sarif_file: results.sarif | ||
0 commit comments