The chart cards were pure white in a dark application #153
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OpenSSF Scorecard | |
| # Runs the OpenSSF Scorecard checks and publishes the result to GitHub's code | |
| # scanning view, so supply-chain posture is visible in the same place as CodeQL | |
| # findings rather than living in someone's head. | |
| # | |
| # Why this is here rather than aspirational: the roadmap records artefact signing | |
| # and a published Scorecard as the two outstanding supply-chain items. SBOMs | |
| # (SPDX + CycloneDX) already ship with every release; this closes the measurement | |
| # half. Several checks will fail on a single-maintainer repository by design - | |
| # Branch-Protection and Code-Review both effectively require a second pair of | |
| # eyes - and that is fine. The value is the trend and the checks that *are* | |
| # actionable: Pinned-Dependencies, Token-Permissions, Dangerous-Workflow. | |
| # | |
| # Runs weekly and on pushes to the default branch. Scorecard needs the default | |
| # branch to compute several checks, so it deliberately does not run on PRs. | |
| on: | |
| schedule: | |
| # Sunday 04:17 UTC. Offset from the hour because everything runs on the hour | |
| # and the shared runner pool is busiest then. | |
| - cron: '17 4 * * 0' | |
| push: | |
| branches: [ master ] | |
| workflow_dispatch: | |
| permissions: read-all | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Needed to upload the SARIF result to code scanning. | |
| security-events: write | |
| # Needed by the action to read the workflow run and repository metadata. | |
| id-token: write | |
| contents: read | |
| actions: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| # Pinned to a full commit SHA, not a tag, for two reasons. | |
| # | |
| # The first is that it has to be: ossf/scorecard-action publishes only point | |
| # tags (v2.4.4, v2.4.3, ...) and has no moving `v2`. This step said `@v2`, which | |
| # cannot resolve - "Unable to resolve action ossf/scorecard-action@v2, unable to | |
| # find version `v2`" - so this workflow failed at set-up on every single run since | |
| # it was added and produced no SARIF at all. It failed six times out of six, and | |
| # because it fails in Set up job rather than in the analysis, the log looks like | |
| # infrastructure noise rather than a broken reference. | |
| # | |
| # The second is that pinning by SHA is the thing Scorecard itself measures. Its | |
| # Pinned-Dependencies check marks a tag reference down precisely because a tag can | |
| # be moved, and a supply-chain scanner referenced by a mutable tag is a | |
| # supply-chain hole in the tool that is meant to find them. So the version comment | |
| # is for humans and the SHA is the contract. | |
| # | |
| # To upgrade: read the SHA from the release, not from a tag lookup that a mirror | |
| # could answer, and change the comment in the same edit. | |
| uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 | |
| with: | |
| results_file: scorecard-results.sarif | |
| results_format: sarif | |
| # publish_results uploads to the public OpenSSF API so the score can be | |
| # shown as a badge. Left off deliberately: this is a mail server fork | |
| # and there is no reason to publish repository telemetry to a third | |
| # party to get a number we can read ourselves in code scanning. | |
| publish_results: false | |
| - name: Upload SARIF to code scanning | |
| uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 | |
| with: | |
| sarif_file: scorecard-results.sarif | |
| - name: Keep the raw result as an artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: scorecard-results | |
| path: scorecard-results.sarif | |
| retention-days: 30 |