OpenSSF Scorecard #154
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OpenSSF Scorecard | |
| # Issue #178 criterion 6. Cortex adopts the ecosystem's single Scorecard | |
| # definition as a CALL SITE, not a copy: the reusable workflow lives in | |
| # cdeust/ai-architect-mcp-codebase (AP #66/#77) so the pinned action SHAs and the | |
| # report-only policy are maintained in one place. Scorecard grades repo-level | |
| # posture (branch protection, signing, review counts) and is language- | |
| # agnostic, which is exactly the part of the supply-chain story that | |
| # generalises — SBOM and build provenance stay per-repo in release.yml because | |
| # their toolchains differ (uv/pip here, cargo there, pnpm in prd-gen). | |
| # | |
| # The first score is a BASELINE recorded as-is: a low number is a valid | |
| # measurement (§8), not a failure, and this deliberately does not gate a PR — | |
| # a contributor cannot fix repo-level policy inside their diff. | |
| on: | |
| schedule: | |
| - cron: "0 7 * * 2" # Tuesdays 07:00 UTC — posture drifts by inaction | |
| branch_protection_rule: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| # REVERSAL NOTE (post-merge fix, issue #178): the call-site pattern | |
| # (uses: cdeust/ai-architect-mcp-codebase/.../scorecard.yml@main) produced | |
| # startup_failure on main — zero jobs spawned — and scorecard-action's | |
| # publish_results requires the OIDC subject to be THIS repo's own | |
| # default-branch workflow, so a cross-repo reusable call cannot publish | |
| # even when it starts. In-repo canonical template instead; the pinned | |
| # SHAs below match the AP definition and drift is caught by Scorecard | |
| # itself flagging unpinned/stale actions. This workflow only runs on | |
| # main/schedule, so PR CI could not have caught the failure: verified | |
| # post-merge via workflow_dispatch. | |
| permissions: read-all | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # upload SARIF to code scanning | |
| id-token: write # publish signed results to the OpenSSF API | |
| contents: read | |
| actions: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - name: Upload SARIF to code scanning | |
| uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 | |
| with: | |
| sarif_file: results.sarif |