| 1 | name: Scorecard |
| 2 | |
| 3 | # OpenSSF Scorecard tracks broader repo security-health drift (branch |
| 4 | # protection, token permissions, pinned actions, dangerous workflows, CI |
| 5 | # tests, maintenance signals) on a schedule, complementing the per-diff |
| 6 | # dependency-audit and secret-scan jobs in security.yml. |
| 7 | # |
| 8 | # Advisory-first: this workflow only measures and publishes a score, and it |
| 9 | # never blocks merges. It runs on the default branch (Scorecard needs repo-level |
| 10 | # data and a token, so it is not meaningful on PR forks) plus a weekly schedule |
| 11 | # so regressions in security health surface even when no code changes. |
| 12 | |
| 13 | on: |
| 14 | branch_protection_rule: |
| 15 | schedule: |
| 16 | # Weekly, Mondays at 07:00 UTC. |
| 17 | - cron: '0 7 * * 1' |
| 18 | push: |
| 19 | branches: |
| 20 | - main |
| 21 | workflow_dispatch: |
| 22 | |
| 23 | # Top-level token is read-only; the analysis job widens only what it needs. |
| 24 | permissions: read-all |
| 25 | |
| 26 | jobs: |
| 27 | analysis: |
| 28 | name: Scorecard analysis |
| 29 | runs-on: ubuntu-latest |
| 30 | # Job-level permissions fully replace the top-level block (unlisted scopes |
| 31 | # default to none), so the reads checkout and Scorecard need are explicit. |
| 32 | permissions: |
| 33 | # Needed by actions/checkout to clone the repo, and by Scorecard to read |
| 34 | # workflow files for its Dangerous-Workflow / Token-Permissions checks. |
| 35 | contents: read |
| 36 | actions: read |
| 37 | # Needed to upload the SARIF results to the code-scanning dashboard. |
| 38 | security-events: write |
| 39 | # Needed to publish results and obtain a badge (uses OIDC, no secrets). |
| 40 | id-token: write |
| 41 | |
| 42 | steps: |
| 43 | - name: Checkout |
| 44 | uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
| 45 | with: |
| 46 | persist-credentials: false |
| 47 | |
| 48 | - name: Run OpenSSF Scorecard |
| 49 | uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 |
| 50 | with: |
| 51 | results_file: scorecard.sarif |
| 52 | results_format: sarif |
| 53 | # Publishes results to the OpenSSF REST API for the public badge and |
| 54 | # trend tracking. Set to false if maintainers prefer to keep the |
| 55 | # score private (the SARIF upload below still works either way). |
| 56 | publish_results: true |
| 57 | |
| 58 | # Retain the raw SARIF as a build artifact for offline inspection. |
| 59 | - name: Upload artifact |
| 60 | uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 |
| 61 | with: |
| 62 | name: scorecard-sarif |
| 63 | path: scorecard.sarif |
| 64 | retention-days: 5 |
| 65 | |
| 66 | - name: Upload SARIF to code-scanning |
| 67 | uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 |
| 68 | with: |
| 69 | sarif_file: scorecard.sarif |
| 70 |