1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
name: OSSF Scorecard
# OpenSSF Scorecard — automated supply-chain / security-posture scoring
# (branch protection, pinned actions, token permissions, dangerous workflows,
# dependency-update tooling, etc.). Results publish to the Security tab and,
# optionally, the public Scorecard API for an OSS "security score" badge.
#
# ── RUNNER / COST / VISIBILITY ────────────────────────────────────────────────
# Scorecard is built for GitHub-hosted runners and is most useful on a PUBLIC
# repo (many checks — e.g. branch-protection introspection, the public results
# badge — assume public + a repo `read` token). It runs on `ubuntu-latest`.
# The repo is public, so `publish_results: true` takes effect and the runs are
# free.
on:
branch_protection_rule: # re-score when branch protection changes
schedule:
- cron: "18 5 * * 1" # Mondays 05:18 UTC
push:
branches:
permissions: read-all
jobs:
analysis:
name: Scorecard analysis
# Scorecard is only meaningful on a PUBLIC repo (publish + branch-protection
# checks). Skipped on a private repo (e.g. a private fork) so it neither
# burns Actions minutes nor fails; this repo is public, so it runs here.
if: ${{ github.event.repository.private == false }}
runs-on: ubuntu-latest # GitHub-hosted; free for this public repo
permissions:
security-events: write # upload SARIF to the Security tab
id-token: write # publish results to the Scorecard API (public)
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
with:
persist-credentials: false
- name: Run Scorecard
uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
with:
results_file: results.sarif
results_format: sarif
# Publishes to the public OSSF Scorecard API + enables the badge.
# A no-op on a private repo; effective here.
publish_results: true
- name: Upload SARIF to code scanning
uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
with:
sarif_file: results.sarif