scorecard.yml

# Advisory OpenSSF Scorecard (https://github.com/ossf/scorecard-action). Not part of CI / Gate, no score target.
# With publish_results: true the Scorecard API verifies this file and rejects: workflow-level or job-level `env` and
# `defaults`, workflow-level write permissions, `id-token: write` outside this job, `container`/`services`, `run:`
# steps and actions outside its allowlist. This file therefore deliberately does NOT follow the repository's
# `defaults: run: shell: pwsh` convention. Publication works from the default branch only (post-merge check).
# Review-related scores may remain low for a single maintainer. Main requires the GitHub Actions CI / Gate check,
# an up-to-date branch and verified commit signatures; independent reviewer approvals remain optional.
# Repository age and an OpenSSF badge require their own evidence and must not be claimed from passing CI.
name: Scorecard

on:
  branch_protection_rule:
  push:
    branches: [ main ]
  schedule:
    - cron: '41 5 * * 1'

permissions:
  contents: read

jobs:
  analysis:
    name: Scorecard analysis
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read
      security-events: write # upload the SARIF results to code scanning
      id-token: write # publish_results: signed upload to the Scorecard API
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # No repo_token: rulesets are readable with the default token.
      - name: Run Scorecard
        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
        with:
          results_file: results.sarif
          results_format: sarif
          publish_results: true

      - name: Upload results
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: scorecard-results
          path: results.sarif
          retention-days: 5

      - name: Upload to code scanning
        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          sarif_file: results.sarif