Bump install-pinned/uv from 09493a8894e089d8b84f332d948a72bdd8fb3638 to a1c8d54c22711715919a4c208689ed99f0eba797 #1416
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow uses actions that are not certified by GitHub. They are provided | |
| # by a third-party and are governed by separate terms of service, privacy | |
| # policy, and support documentation. | |
| name: Scorecard supply-chain security | |
| on: | |
| # For Branch-Protection check. Only the default branch is supported. See | |
| # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection | |
| branch_protection_rule: | |
| # To guarantee Maintained check is occasionally updated. See | |
| # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained | |
| pull_request: | |
| branches: [ "main", "major-release" ] | |
| schedule: | |
| - cron: '45 16 * * 2' | |
| # Declare default permissions as read only. | |
| permissions: read-all | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Needed to upload the results to code-scanning dashboard. | |
| security-events: write | |
| # Needed to publish results and get a badge (see publish_results below). | |
| id-token: write | |
| # Uncomment the permissions below if installing in a private repository. | |
| # contents: read | |
| # actions: read | |
| steps: | |
| - uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.deps.dev:443 | |
| api.github.com:443 | |
| api.osv.dev:443 | |
| api.scorecard.dev:443 | |
| api.securityscorecards.dev:443 | |
| auth.docker.io:443 | |
| fulcio.sigstore.dev:443 | |
| github.com:443 | |
| index.docker.io:443 | |
| oss-fuzz-build-logs.storage.googleapis.com:443 | |
| rekor.sigstore.dev:443 | |
| tuf-repo-cdn.sigstore.dev:443 | |
| www.bestpractices.dev:443 | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 | |
| with: | |
| persist-credentials: false | |
| - uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - uses: github/codeql-action/upload-sarif@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 | |
| with: | |
| sarif_file: results.sarif |