Scorecard supply-chain security #70

	## %CopyrightBegin%
	##
	## SPDX-License-Identifier: Apache-2.0
	##
	## Copyright Ericsson AB 2026. All Rights Reserved.
	##
	## Licensed under the Apache License, Version 2.0 (the "License");
	## you may not use this file except in compliance with the License.
	## You may obtain a copy of the License at
	##
	## http://www.apache.org/licenses/LICENSE-2.0
	##
	## Unless required by applicable law or agreed to in writing, software
	## distributed under the License is distributed on an "AS IS" BASIS,
	## WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	## See the License for the specific language governing permissions and
	## limitations under the License.
	##
	## %CopyrightEnd%

	name: Scorecard supply-chain security

	on:
	workflow_dispatch:
	branch_protection_rule:
	schedule:
	- cron: '0 13 * * *'
	push:
	branches:
	- master

	permissions:
	contents: read
	actions: read

	jobs:
	analysis:
	name: Scorecard analysis
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	id-token: write # needed to publish to scorecard.dev
	contents: read
	actions: read

	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Run analysis
	uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # ratchet:ossf/scorecard-action@v2.4.3
	with:
	results_file: results.sarif
	results_format: sarif
	publish_results: true

Navigation Menu