Merge pull request #129 from b7n0de/ci/mutation-mutant-fangnetz #119
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Scorecard | |
| # OpenSSF Scorecard — supply-chain posture (pinned deps, token permissions, branch protection, | |
| # dangerous workflows, SAST, fuzzing, signed releases). Publishes results so the badge works. | |
| # The high-leverage checks this repo already maxes: Pinned-Dependencies (all actions SHA-pinned), | |
| # Token-Permissions (read-all top-level, per-job escalation), SAST (CodeQL), Fuzzing (Hypothesis). | |
| on: | |
| branch_protection_rule: | |
| schedule: | |
| - cron: "0 7 * * 1" | |
| push: | |
| branches: [main] | |
| permissions: read-all | |
| jobs: | |
| analysis: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # upload SARIF | |
| id-token: write # required by publish_results from scorecard-action v2+ | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run Scorecard analysis | |
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - name: Upload SARIF to code scanning | |
| uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 | |
| with: | |
| sarif_file: results.sarif |