Refresh grype_me Security Badges #151

	---
	name: Refresh grype_me Security Badges

	on:
	schedule:
	- cron: '0 8 * * *' # every day at 08:00 UTC
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	update-badge:
	runs-on: ubuntu-latest
	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
	with:
	egress-policy: audit

	- name: Ensure required secrets is set
	shell: bash
	env:
	GIST_TOKEN: ${{ secrets.GIST_TOKEN }}
	run: \|
	set -euo pipefail
	if [[ -z "$GIST_TOKEN" ]]; then
	echo "Missing required secret: GIST_TOKEN" >&2
	exit 1
	fi

	- name: Checkout repository (with tags)
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	# fetch-depth: 0 (non-default) - fetch full history to ensure tag lookups work correctly
	fetch-depth: 0
	# fetch-tags: true (non-default) - need tags to detect latest_release for the badge
	fetch-tags: true

	- name: grype_me latest_release of GitHub Action
	id: grype_me_release
	uses: TomTonic/grype_me@v1 # don't pin, rolling tag changes daily
	with:
	scan: 'latest_release'
	fail-build: false
	gist-token: ${{ secrets.GIST_TOKEN }}
	gist-id: cbfad7cf38e139ba898fe41386efa4db
	gist-filename: 'release_scan'

Provide feedback