Website/.github/workflows/scorecard.yml at main · StabilityNexus/Website · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
name: Scorecard supply-chain security

# ⚠️ API INTEGRITY RULES (enforced when publish_results: true):
#   - NO top-level `env:` or `defaults:` blocks in this file
#   - NO workflow-level write permissions
#   - ONLY this job may use id-token: write
# Violating any of these causes the publish step to be REJECTED by api.scorecard.dev

on:
  branch_protection_rule:

  schedule:
    - cron: '23 8 * * 6'

  push:
    # Branch-Protection check ONLY works on the default branch (Must match your actual default branch).
    branches: ["main"]

  workflow_dispatch:

permissions: read-all

jobs:
  analysis:
    name: Scorecard analysis
    runs-on: ubuntu-latest

    if: |
      !github.event.repository.fork &&
      (github.event.repository.default_branch == github.ref_name ||
       github.event_name == 'workflow_dispatch' ||
       github.event_name == 'pull_request')

    permissions:
      security-events: write
      id-token: write
      actions: read
      contents: read

    steps:
      - name: "Harden Runner"
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          disable-sudo-and-containers: false
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            api.github.com:443
            codeload.github.com:443
            *.actions.githubusercontent.com:443
            *.blob.core.windows.net:443
            index.docker.io:443
            api.osv.dev:443
            api.scorecard.dev:443
            fulcio.sigstore.dev:443
            rekor.sigstore.dev:443
            sigstore-tuf-root.storage.googleapis.com:443
            oauth2.sigstore.dev:443

      - name: "Checkout code"
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: "Run analysis"
        uses: ossf/scorecard-action@v2.4.0
        with:
          results_file: results.sarif
          results_format: sarif
          publish_results: true

      - name: "Upload artifact"
        uses: actions/upload-artifact@v4
        with:
          name: SARIF file
          path: results.sarif
          retention-days: 5

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif