From 22036e7b879fb025213755be0761b12b8e284e65 Mon Sep 17 00:00:00 2001 From: Amit Kumar Date: Wed, 22 Apr 2026 23:25:21 +0000 Subject: [PATCH] ci: add OSSF Scorecard workflow Publishes weekly scorecard results to scorecard.dev, populating the OpenSSF Score badge in README. Actions pinned by SHA per scorecard's own recommendation. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/scorecard.yml | 45 +++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..b76fead --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,45 @@ +name: scorecard + +on: + branch_protection_rule: + schedule: + - cron: '0 6 * * 1' + push: + branches: [main] + +permissions: read-all + +jobs: + analysis: + name: scorecard analysis + runs-on: ubuntu-latest + permissions: + security-events: write + id-token: write + contents: read + actions: read + + steps: + - name: checkout + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false + + - name: run scorecard + uses: ossf/scorecard-action@99c09fe975337306107572b4fdf4db224cf8e2f2 # v2.4.3 + with: + results_file: results.sarif + results_format: sarif + publish_results: true + + - name: upload artifact + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 + with: + name: scorecard-results + path: results.sarif + retention-days: 5 + + - name: upload sarif to code scanning + uses: github/codeql-action/upload-sarif@865f5f5c36632f18690a3d569fa0a764f2da0c3e # v3 + with: + sarif_file: results.sarif