ci: add OpenSSF Scorecard workflow and README badge#777
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| security-events: write | ||
| steps: | ||
| - name: Checkout project | ||
| uses: actions/checkout@v6 |
Check warning
Code scanning / Scorecard
Pinned-Dependencies Medium
| persist-credentials: false | ||
|
|
||
| - name: Run analysis | ||
| uses: ossf/scorecard-action@v2.4.3 |
Check warning
Code scanning / Scorecard
Pinned-Dependencies Medium
| publish_results: ${{ github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }} | ||
|
|
||
| - name: Upload SARIF report | ||
| uses: github/codeql-action/upload-sarif@v4 |
Check warning
Code scanning / Scorecard
Pinned-Dependencies Medium
| sarif_file: results.sarif | ||
|
|
||
| - name: Upload artifact | ||
| uses: actions/upload-artifact@v7 |
Check warning
Code scanning / Scorecard
Pinned-Dependencies Medium
|
@sofianlak Thanks for the PR, interesting. Looks good to be merged as is, we might adapt the workflow afterwards depending on what it brings and the needs it addresses |
3 participants
Closes #776