forked from prometheus/client_java
-
Notifications
You must be signed in to change notification settings - Fork 0
46 lines (40 loc) · 1.34 KB
/
Copy pathscorecard.yml
File metadata and controls
46 lines (40 loc) · 1.34 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
---
name: OSSF Scorecard
on:
push:
branches: [main]
schedule:
- cron: "43 6 * * 5" # Weekly Friday 06:43 UTC
workflow_dispatch:
permissions: {}
jobs:
analysis:
name: Scorecard analysis
runs-on: ubuntu-24.04
# Prevents fork runs from failing due to missing write permissions or secrets.
if: ${{ github.repository == 'prometheus/client_java' }}
permissions:
contents: read
security-events: write # required to upload SARIF results
id-token: write # required by scorecard-action for OIDC token
steps:
- name: Checkout repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
with:
persist-credentials: false
- name: Run OSSF Scorecard analysis
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
with:
results_file: results.sarif
results_format: sarif
publish_results: true
- name: Upload artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: SARIF file
path: results.sarif
retention-days: 5
- name: Upload to code scanning
uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
with:
sarif_file: results.sarif