From 4567a8e27e31ca809db3b23b226a3fd465d0baf4 Mon Sep 17 00:00:00 2001 From: Andy B Date: Wed, 29 Jul 2026 08:50:59 +0300 Subject: [PATCH] Add a private OpenSSF Scorecard workflow Runs ossf/scorecard-action on push to main, weekly, and on workflow_dispatch/branch_protection_rule changes. Results go only to this repo's own Security > Code scanning tab via SARIF (publish_results: false), never to the public Scorecard API/badge - informational baseline, not a CI gate. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/scorecard.yml | 42 +++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..14b16ce --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,42 @@ +name: Scorecard supply-chain security +on: + branch_protection_rule: + schedule: + - cron: '21 5 * * 1' + push: + branches: ["main"] + workflow_dispatch: + +permissions: read-all + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + permissions: + security-events: write + steps: + - name: "Checkout code" + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + with: + results_file: results.sarif + results_format: sarif + # Do not publish results to the public OpenSSF API. + publish_results: false + + - name: "Upload artifact" + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 + with: + sarif_file: results.sarif