Scorecards supply-chain security #74
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OpenSSF Scorecard Checks Workflow | |
| # | |
| # This workflow uses ossf/scorecard-action action to check repo based on | |
| # OpenSSF Scorecard requirements / best practices | |
| # | |
| # Key Features: | |
| # - Check the repo based on OpenSSF Scorecard requirements | |
| # - Upload results into Security tab and OpenSSF | |
| # - Scheduled daily scans | |
| # | |
| # Process Stages: | |
| # 1. Scheduled Execution (Daily at 2 AM UTC) | |
| # 2. Manual Execution | |
| # | |
| # Required Permissions: | |
| # - id-token: write | |
| # - security-events: write | |
| # | |
| # Note: Results are available in the Security tab and | |
| # https://scorecard.dev/viewer/?uri=github.com/open-edge-platform/anomalib | |
| name: Scorecards supply-chain security | |
| on: | |
| # For Branch-Protection check. Only the default branch is supported. See | |
| # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection | |
| branch_protection_rule: | |
| schedule: | |
| # Run security checks every day at 2 AM UTC | |
| - cron: "0 2 * * *" | |
| workflow_dispatch: | |
| permissions: {} | |
| jobs: | |
| analysis: | |
| name: Scorecards analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Needed to upload the results to code-scanning dashboard | |
| security-events: write | |
| # Needed to publish results and get a badge | |
| id-token: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| # Upload the results to GitHub's code scanning dashboard | |
| - name: Upload to code-scanning | |
| uses: github/codeql-action/upload-sarif@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.30.6 | |
| with: | |
| sarif_file: results.sarif |