|
| 1 | +name: Scorecard analysis |
| 2 | + |
| 3 | +# Runs OpenSSF Scorecard supply-chain analysis directly via ossf/scorecard-action |
| 4 | +# (no composite wrapper, no cross-org dependency). All action refs are SHA-pinned. |
| 5 | +# |
| 6 | +# Scorecard requirements |
| 7 | +# ────────────────────── |
| 8 | +# • Supported triggers (per OSSF) are push and schedule on the default branch. |
| 9 | +# pull_request is added below ONLY as a smoke test on a real runner from the PR. |
| 10 | +# workflow_dispatch provides manual smoke tests after this workflow exists on the default branch. |
| 11 | +# OSSF officially documents both triggers as EXPERIMENTAL ("The pull_request and |
| 12 | +# workflow_dispatch triggers are experimental" — scorecard-action README); the docs do not |
| 13 | +# detail how results differ on them. Because they are experimental, treat a PR run as a |
| 14 | +# smoke signal only — this workflow is fully validated only after merge to the default branch. |
| 15 | +# • The checkout step MUST set persist-credentials: false (required by Scorecard's |
| 16 | +# security model to avoid leaking the GITHUB_TOKEN into the analysis environment). |
| 17 | +# • publish_results: true publishes to the public Scorecard API and enables the |
| 18 | +# Scorecard badge. It requires id-token: write on the job AND a push/schedule |
| 19 | +# event — it must stay false on pull_request/workflow_dispatch. Set to 'false' to |
| 20 | +# keep results private (id-token can then be omitted from the job permissions). |
| 21 | + |
| 22 | +on: |
| 23 | + push: |
| 24 | + branches: ['master'] |
| 25 | + pull_request: |
| 26 | + branches: ['master'] # EXPERIMENTAL per OSSF: smoke test only, not an authoritative result |
| 27 | + workflow_dispatch: {} # EXPERIMENTAL per OSSF: manual re-run, available only after merge (default-branch copy) |
| 28 | + schedule: |
| 29 | + - cron: '30 1 * * 6' # weekly, Saturday 01:30 UTC |
| 30 | + |
| 31 | +permissions: read-all # default: restrict everything; the job overrides what it needs |
| 32 | + |
| 33 | +jobs: |
| 34 | + analysis: |
| 35 | + name: Scorecard analysis |
| 36 | + runs-on: ubuntu-latest |
| 37 | + # No event guard: pull_request and workflow_dispatch are allowed to run as an |
| 38 | + # experimental smoke test (see the header). Keep publish_results: false on those |
| 39 | + # events — publishing requires a push/schedule event and id-token: write. |
| 40 | + permissions: |
| 41 | + security-events: write # upload SARIF to the Security tab / Code Scanning dashboard |
| 42 | + # id-token: write # OIDC token for Scorecard's public API publishing (publish_results: true) |
| 43 | + # Uncomment this line only when you set publish_results: true |
| 44 | + contents: read # checkout the repository |
| 45 | + |
| 46 | + steps: |
| 47 | + - name: Checkout code |
| 48 | + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
| 49 | + with: |
| 50 | + persist-credentials: false # required by Scorecard — do not remove |
| 51 | + |
| 52 | + - name: Run analysis |
| 53 | + uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 |
| 54 | + with: |
| 55 | + results_file: results.sarif |
| 56 | + results_format: sarif |
| 57 | + # publish_results: true publishes to the Scorecard public dataset and enables the badge. |
| 58 | + # Requires id-token: write above and a push/schedule event. |
| 59 | + # Set to 'true' (and enable id-token: write) to publish results to the Scorecard public dataset. |
| 60 | + publish_results: false |
| 61 | + |
| 62 | + # Upload SARIF as a workflow artifact (optional — comment out to disable). |
| 63 | + # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts |
| 64 | + - name: Upload artifact |
| 65 | + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 |
| 66 | + with: |
| 67 | + name: SARIF file |
| 68 | + path: results.sarif |
| 69 | + retention-days: 5 # adjust as needed |
| 70 | + |
| 71 | + # Upload SARIF to GitHub Code Scanning dashboard (optional — comment out to disable). |
| 72 | + # Skipped only for fork PRs: there the GITHUB_TOKEN is read-only (no security-events: write) |
| 73 | + # and the upload fails. The guard still runs on push/schedule and on same-repo PRs, where the |
| 74 | + # token can write. (github.event.pull_request is null on push/schedule, so !…fork is true.) |
| 75 | + - name: Upload to code-scanning |
| 76 | + if: ${{ !github.event.pull_request.head.repo.fork }} |
| 77 | + uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 |
| 78 | + with: |
| 79 | + sarif_file: results.sarif |
| 80 | + category: scorecard |
0 commit comments