Repository navigation

Merge "fix: PUT create-or-replace on empty anchor" #615

	---
	# SPDX-License-Identifier: Apache-2.0
	# SPDX-FileCopyrightText: 2025 The Linux Foundation

	# OpenSSF Scorecard assessment for cps.
	#
	# Scorecard scores the repository as a whole rather than a change, so it
	# has no Gerrit variant and never votes: push and schedule on the default
	# branch are the supported triggers. branch_protection_rule is present
	# because the Branch-Protection check cannot score that control without
	# it.
	name: '🔐 OpenSSF Scorecard'

	# yamllint disable-line rule:truthy
	on:
	workflow_dispatch:
	# For the Branch-Protection check, default branch only.
	branch_protection_rule:
	# Keeps the Maintained check fresh even when the repository is quiet.
	schedule:
	- cron: "50 4 * * 0"
	push:
	branches: ["main", "master"]

	# Declare default permissions as none.
	permissions: {}

	jobs:
	openssf-scorecard:
	name: 'OpenSSF Scorecard'
	permissions:
	contents: read # checkout
	security-events: write # upload results to the code scanning dashboard
	id-token: write # publish results and obtain the badge, via OIDC
	actions: read # upload-sarif reads run info
	# id-token: write must appear on no other job in this workflow, and
	# the file must carry no top-level env or defaults; the Scorecard API
	# rejects published results otherwise. See
	# https://github.com/ossf/scorecard-action#workflow-restrictions
	# yamllint disable-line rule:line-length
	uses: lfreleng-actions/security-workflows/.github/workflows/openssf-scorecard.yaml@7483557cf53b18109e679b8a3da42ce8e6dff219 # v0.8.0