chore(deps): bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.9 #147
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 88-Pillar Scorecard | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| statuses: write | |
| jobs: | |
| scorecard: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Run 88-Pillar Scorecard Audit | |
| id: audit | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| run: | | |
| THRESHOLD=85 | |
| ENFORCE=true | |
| if [ "$EVENT_NAME" = "pull_request" ]; then | |
| ENFORCE=false | |
| fi | |
| # Run audit in JSON mode. Exit 1 means an advisory threshold drop; | |
| # any other exit code is an execution/contract failure and must stop | |
| # before attempting to parse a possibly empty report. | |
| set +e | |
| python scripts/scorecard_ci.py . --output json --threshold "$THRESHOLD" --fail-on-drop > scorecard-report.json 2> scorecard-stderr.txt | |
| AUDIT_STATUS=$? | |
| set -e | |
| if [ "$AUDIT_STATUS" -ne 0 ] && [ "$AUDIT_STATUS" -ne 1 ]; then | |
| echo "Scorecard audit failed with exit code $AUDIT_STATUS." >&2 | |
| cat scorecard-stderr.txt >&2 | |
| exit "$AUDIT_STATUS" | |
| fi | |
| if [ "$AUDIT_STATUS" -eq 1 ]; then | |
| echo "Scorecard is below the canonical-main threshold; continuing to publish the report." | |
| fi | |
| # Extract score | |
| SCORE=$(python -c "import json; r=json.load(open('scorecard-report.json')); print(r['score'])") | |
| TOTAL=$(python -c "import json; r=json.load(open('scorecard-report.json')); print(r['total'])") | |
| PCT=$(python -c "import json; r=json.load(open('scorecard-report.json')); print(f\"{r['percentage']:.1f}\")") | |
| # Generate markdown summary | |
| echo "## 88-Pillar Scorecard Result" > scorecard-summary.md | |
| echo "" >> scorecard-summary.md | |
| echo "| Metric | Value |" >> scorecard-summary.md | |
| echo "|--------|-------|" >> scorecard-summary.md | |
| echo "| **Score** | **${SCORE}/${TOTAL}** (${PCT}%) |" >> scorecard-summary.md | |
| echo "| **Threshold** | ${THRESHOLD} |" >> scorecard-summary.md | |
| if [ "$SCORE" -ge "$THRESHOLD" ]; then | |
| STATUS="PASS" | |
| elif [ "$ENFORCE" = "true" ]; then | |
| STATUS="FAIL" | |
| else | |
| STATUS="ADVISORY" | |
| fi | |
| echo "| **Status** | ${STATUS} |" >> scorecard-summary.md | |
| echo "" >> scorecard-summary.md | |
| # List failed pillars | |
| if [ "$SCORE" -lt "$THRESHOLD" ]; then | |
| echo "### Failed Pillars" >> scorecard-summary.md | |
| echo "" >> scorecard-summary.md | |
| python -c " | |
| import json | |
| r = json.load(open('scorecard-report.json')) | |
| for item in r['results']: | |
| if not item['passed']: | |
| print(f'- [ ] Pillar #{item[\"id\"]}: **{item[\"name\"]}**') | |
| " >> scorecard-summary.md | |
| fi | |
| # Set outputs | |
| echo "score=${SCORE}" >> "$GITHUB_OUTPUT" | |
| echo "total=${TOTAL}" >> "$GITHUB_OUTPUT" | |
| echo "percentage=${PCT}" >> "$GITHUB_OUTPUT" | |
| echo "threshold=${THRESHOLD}" >> "$GITHUB_OUTPUT" | |
| if [ "$SCORE" -ge "$THRESHOLD" ] || [ "$ENFORCE" = "false" ]; then | |
| echo "passed=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "passed=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| echo "enforce=${ENFORCE}" >> "$GITHUB_OUTPUT" | |
| # Post PR comment if applicable | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| COMMENT=$(cat scorecard-summary.md) | |
| # Use GitHub API to post comment | |
| if command -v gh &> /dev/null; then | |
| gh pr comment "${{ github.event.pull_request.number }}" \ | |
| --body "$COMMENT" \ | |
| --repo "${{ github.repository }}" || true | |
| fi | |
| fi | |
| - name: Update status check | |
| if: always() | |
| run: | | |
| SCORE=${{ steps.audit.outputs.score }} | |
| TOTAL=${{ steps.audit.outputs.total }} | |
| THRESHOLD=${{ steps.audit.outputs.threshold }} | |
| PASSED=${{ steps.audit.outputs.passed }} | |
| if [ "$PASSED" = "true" ]; then | |
| echo "Scorecard: ${SCORE}/${TOTAL} - PASS (threshold: ${THRESHOLD})" | |
| else | |
| echo "Scorecard: ${SCORE}/${TOTAL} - FAIL (threshold: ${THRESHOLD})" | |
| exit 1 | |
| fi | |
| - name: Upload scorecard report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: scorecard-report | |
| path: | | |
| scorecard-report.json | |
| scorecard-summary.md | |
| - name: Check score threshold on canonical main | |
| if: steps.audit.outputs.passed != 'true' | |
| run: | | |
| echo "::error::Score ${{ steps.audit.outputs.score }}/${{ steps.audit.outputs.total }} is below threshold ${{ steps.audit.outputs.threshold }}" | |
| exit 1 | |
| update-badge: | |
| needs: scorecard | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| steps: | |
| - name: Update scorecard badge | |
| run: | | |
| SCORE=${{ needs.scorecard.outputs.score }} | |
| TOTAL=${{ needs.scorecard.outputs.total }} | |
| PCT=${{ needs.scorecard.outputs.percentage }} | |
| # Generate badge SVG | |
| if [ "${{ needs.scorecard.outputs.passed }}" = "true" ]; then | |
| COLOR="brightgreen" | |
| else | |
| COLOR="red" | |
| fi | |
| BADGE_URL="https://img.shields.io/badge/scorecard-${SCORE}%2F${TOTAL}-${COLOR}" | |
| echo "Badge URL: ${BADGE_URL}" | |
| # Update README badge if it exists | |
| if [ -f "README.md" ]; then | |
| sed -i "s|!\[Scorecard\].*|[](https://github.com/${{ github.repository }}/actions)|g" README.md || true | |
| fi |