scorecard.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: "Scorecard security analysis"

on:
  push:
    branches: ["master"]
  schedule:
    - cron: "25 10 * * 3"
  workflow_dispatch:

permissions: {}

jobs:
  analyze:
    name: "Scorecard security analysis"
    runs-on: "ubuntu-latest"
    permissions:
      actions: "read"
      contents: "read"
      security-events: "write"
    steps:
      - name: "Checkout"
        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"
      - name: "Perform security analysis"
        uses: "ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a"
        with:
          results_file: "./results.sarif"
          results_format: "sarif"
          repo_token: "${{ secrets.GITHUB_TOKEN }}"
          publish_results: false
      - name: "Upload SARIF file"
        uses: "github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e"
        with:
          sarif_file: "./results.sarif"