Skip to content

Commit 2396d08

Browse files
tym83tym83
committed
ci: add OpenSSF Scorecard workflow
Runs the OpenSSF Scorecard action on: - weekly schedule (Mon 06:00 UTC) - branch protection rule changes - pushes to main - manual dispatch Publishes results to: - the public OpenSSF Scorecard API (scorecard.dev) for transparency - the GitHub code-scanning dashboard (Security tab) for triage No README badge is added yet — the badge will be introduced in a follow-up PR once the first scans have run and any quick-win improvements (token permissions, dependency pinning) have landed. Aligns with the project's CNCF Incubation readiness work and the security self-assessment in progress. Signed-off-by: Timur Tukaev <[email protected]>
1 parent b689613 commit 2396d08

1 file changed

Lines changed: 55 additions & 0 deletions

File tree

‎.github/workflows/scorecard.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: OpenSSF Scorecard
2+
3+
on:
4+
branch_protection_rule:
5+
schedule:
6+
# Run weekly on Mondays at 06:00 UTC.
7+
- cron: '0 6 * * 1'
8+
push:
9+
branches: [main]
10+
workflow_dispatch:
11+
12+
# Declare default permissions as read-only.
13+
permissions: read-all
14+
15+
jobs:
16+
analysis:
17+
name: Scorecard analysis
18+
runs-on: ubuntu-latest
19+
permissions:
20+
# Needed to upload the results to the GitHub code-scanning dashboard.
21+
security-events: write
22+
# Needed to publish results to the public scorecard.dev API
23+
# (OIDC token allows publish without storing long-lived credentials).
24+
id-token: write
25+
# Needed to read repository contents.
26+
contents: read
27+
# Needed to read workflow definitions for the Dangerous-Workflow check.
28+
actions: read
29+
30+
steps:
31+
- name: Checkout repository
32+
uses: actions/checkout@v4
33+
with:
34+
persist-credentials: false
35+
36+
- name: Run analysis
37+
uses: ossf/scorecard-action@v2
38+
with:
39+
results_file: results.sarif
40+
results_format: sarif
41+
# Publish the results to the OpenSSF Scorecard public API so the
42+
# project appears at https://scorecard.dev/viewer/?uri=github.com/cozystack/cozystack
43+
publish_results: true
44+
45+
- name: Upload SARIF as artifact
46+
uses: actions/upload-artifact@v4
47+
with:
48+
name: scorecard-sarif
49+
path: results.sarif
50+
retention-days: 5
51+
52+
- name: Upload SARIF to code-scanning
53+
uses: github/codeql-action/upload-sarif@v3
54+
with:
55+
sarif_file: results.sarif

0 commit comments

Comments
 (0)