scorecard #22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OpenSSF Scorecard: automated supply-chain hygiene checks (token permissions, pinned dependencies, | |
| # branch protection, dangerous workflow patterns, ...). Results land in the repo's code-scanning tab | |
| # and on the public report at | |
| # https://scorecard.dev/viewer/?uri=github.com/ConfigButler/krm-stream | |
| # | |
| # This is not decoration. A library whose whole pitch is "import this into your browser and trust what | |
| # it tells you about your cluster" is asking for a lot of trust, and it should be able to show its | |
| # working. | |
| # | |
| # There is deliberately NO repo_token here. A PAT is needed only to read CLASSIC branch protection; | |
| # `main` uses a repository RULESET instead, which the default GITHUB_TOKEN can read, so | |
| # Branch-Protection scores without one. That is the better posture, not a shortcut: a PAT with repo | |
| # scope is a long-lived write credential stored as a secret, in a workflow whose whole job is to | |
| # attest that the supply chain is sound. | |
| name: scorecard | |
| on: | |
| branch_protection_rule: | |
| schedule: | |
| - cron: "30 3 * * 1" | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: read-all | |
| jobs: | |
| analysis: | |
| name: scorecard analysis | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| security-events: write # upload SARIF to code scanning | |
| id-token: write # publish results to the public Scorecard API | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: run scorecard analysis | |
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - name: upload SARIF to code scanning | |
| uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 | |
| with: | |
| sarif_file: results.sarif |