1 files changed, 20 insertions, 14 deletions
@@ -2,7 +2,7 @@
 # by a third-party and are governed by separate terms of service, privacy
 # policy, and support documentation.
-name: Scorecards supply-chain security
 on:
 # For Branch-Protection check. Only the default branch is supported. See
 # https://.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
@@ -10,7 +10,7 @@ on:
 # To guarantee Maintained check is occasionally updated. See
 # https://.com/ossf/scorecard/blob/main/docs/checks.md#maintained
 schedule:
- - cron: '22 4 * * 2'
 # push:
 # branches: [ "master" ]
@@ -19,8 +19,10 @@ permissions: read-all
 jobs:
 analysis:
- name: Scorecards analysis
 runs-on: ubuntu-latest
 permissions:
 # Needed to upload the results to code-scanning dasard.
 security-events: write
@@ -31,21 +33,21 @@ jobs:
 # actions: read
 steps:
- - name: 'Checkout code'
 uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 with:
 persist-credentials: false
- - name: 'Run analysis'
- uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
 with:
 results_file: results.sarif
 results_format: sarif
- # (Optional) Read-only PAT token. Uncomment the `repo_token` line below if:
 # - you want to enable the Branch-Protection check on a *public* repository, or
- # - you are installing Scorecards on a *private* repository
- # To create the PAT, follow the steps in https://.com/ossf/scorecard-action#authentication-with-pat.
- repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}
 # Public repositories:
 # - Publish results to OpenSSF REST API for easy access by consumers
@@ -56,17 +58,21 @@ jobs:
 # of the value entered here.
 publish_results: true
 # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
 # format to the repository Actions tab.
 # - name: "Upload artifact"
- # uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
 # with:
 # name: SARIF file
 # path: results.sarif
 # retention-days: 5
- # Upload the results to 's code scanning dasard.
- - name: 'Upload to code-scanning'
- uses: /codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
 with:
 sarif_file: results.sarif