1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
# SPDX-FileCopyrightText: 2026 Noyalib
# SPDX-License-Identifier: MIT OR Apache-2.0
name: OpenSSF Scorecard
# Scores the repository against the public OpenSSF Scorecard rubric
# (signed releases, branch protection, dependency pinning, SAST,
# fuzzing, SLSA provenance, etc.). Results land in Rekor and the
# repo's public security tab; the badge in the README points at the
# live score.
on:
branch_protection_rule:
schedule:
- cron: '0 4 * * 1' # Weekly, Monday 04:00 UTC
push:
branches:
workflow_dispatch:
permissions: read-all
jobs:
analysis:
name: Scorecard analysis
runs-on: ubuntu-latest
permissions:
security-events: write # upload SARIF to Code Scanning
id-token: write # publish results to Rekor
contents: read
actions: read
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.0
with:
results_file: results.sarif
results_format: sarif
publish_results: true
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: scorecard-results
path: results.sarif
retention-days: 7
- uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
with:
sarif_file: results.sarif