netcore.utilities.spreadsheet/.github/workflows/ossf-scorecard.yml at 27f71d8ae1cef92155ba12dec0d71cb4446b0496 · IowaComputerGurus/netcore.utilities.spreadsheet · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
name: "Scorecard supply-chain security"
on:
  # For Branch-Protection check. Only the default branch is supported. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
  branch_protection_rule:

  # To guarantee Maintained check is occasionally updated. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
  schedule:
    - cron: "45 10 * * 0"
  push:
    branches: ["develop"]

# Declare default permissions as read only.
permissions: "read-all"

jobs:
  analysis:
    name: "Scorecard analysis"
    runs-on: "ubuntu-latest"
    if: ${{ github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request' }}
    permissions:
      # Needed to upload the results to code-scanning dashboard.
      security-events: "write"
      # Needed to publish results and get a badge (see publish_results below).
      id-token: "write"

    steps:
      - name: "Checkout code"
        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
        with:
          persist-credentials: false

      - name: "Run analysis"
        uses: "ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a" # v2.4.3
        with:
          results_file: results.sarif
          results_format: sarif

          # Public repositories:
          #   - Publish results to OpenSSF REST API for easy access by consumers
          #   - Allows the repository to include the Scorecard badge.
          #   - See https://github.com/ossf/scorecard-action#publishing-results.
          publish_results: true

      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
        with:
          name: "SARIF file"
          path: "results.sarif"
          retention-days: 5

      # Upload the results to GitHub's code scanning dashboard (optional).
      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
      - name: "Upload to code-scanning"
        uses: "github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225" # v4.35.2
        with:
          sarif_file: "results.sarif"