OpenSSF Scorecard #39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OpenSSF Scorecard - Security health metrics for Open Source | |
| # | |
| # Measures repository security posture and provides recommendations. | |
| # Results are uploaded to GitHub Security tab and OpenSSF Scorecard API. | |
| # | |
| # Triggers: | |
| # - schedule/push: Full analysis with result publishing to OpenSSF API | |
| # - pull_request: Analysis only — catches Dangerous-Workflow (script | |
| # injection) before merge. Publishing disabled (no OIDC on PRs). | |
| # | |
| # TODO: pull_request trigger is experimental per Scorecard docs. | |
| # If it causes issues (fork PRs, permissions), disable pull_request | |
| # and rely on actionlint in security-scans.yaml for PR coverage. | |
| # See: https://github.com/ossf/scorecard-action#workflow-restrictions | |
| # | |
| # Token Requirements: | |
| # - No external tokens needed | |
| # - Uses GITHUB_TOKEN for API access | |
| # - id-token: write needed for OIDC verification when publishing results | |
| # | |
| # Reference: https://securityscorecards.dev/ | |
| # | |
| name: OpenSSF Scorecard | |
| on: | |
| # Run weekly on Monday at 6 AM UTC | |
| schedule: | |
| - cron: '0 6 * * 1' | |
| # Run on push to main | |
| push: | |
| branches: [main] | |
| # Run on PRs to catch Dangerous-Workflow before merge | |
| pull_request: | |
| branches: [main] | |
| # Allow manual trigger | |
| workflow_dispatch: | |
| # Deny all permissions at workflow level; the job declares only what it needs | |
| # See: https://github.com/ossf/scorecard-action#workflow-restrictions | |
| permissions: {} | |
| jobs: | |
| scorecard: | |
| name: Scorecard Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # Upload SARIF to Security tab | |
| id-token: write # OIDC token for result verification | |
| contents: read # Read repository contents | |
| actions: read # Read workflow runs | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Run Scorecard | |
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | |
| with: | |
| results_file: scorecard.sarif | |
| results_format: sarif | |
| # Only publish to OpenSSF API on push/schedule (not PRs — no OIDC token) | |
| publish_results: ${{ github.event_name != 'pull_request' }} | |
| - name: Upload SARIF to Security tab | |
| uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 | |
| with: | |
| sarif_file: scorecard.sarif | |
| - name: Upload Scorecard results as artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: scorecard-results | |
| path: scorecard.sarif | |
| retention-days: 30 |