From 46f516bb5dca148cf9e9e8aabd93d4e7efd119ab Mon Sep 17 00:00:00 2001 From: Mohit Nagaraj Date: Tue, 24 Mar 2026 11:51:07 +0530 Subject: [PATCH] feat: add OpenSSF Scorecard workflow Runs OpenSSF Security Scorecard weekly and on pushes to main. Publishes results to GitHub Security tab via SARIF upload. Closes #3 Signed-off-by: Mohit Nagaraj --- .github/workflows/scorecard.yml | 36 +++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..970b719 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,36 @@ +name: OpenSSF Scorecard + +on: + schedule: + - cron: '0 6 * * 1' # Every Monday at 6:00 UTC + push: + branches: + - main + workflow_dispatch: + +permissions: read-all + +jobs: + analysis: + name: Scorecard Analysis + runs-on: ubuntu-latest + permissions: + security-events: write + id-token: write + steps: + - name: Checkout code + uses: actions/checkout@v4 + with: + persist-credentials: false + + - name: Run OpenSSF Scorecard + uses: ossf/scorecard-action@v2.4.1 + with: + results_file: results.sarif + results_format: sarif + publish_results: true + + - name: Upload to GitHub Security tab + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: results.sarif