From 13924ea5557f0d0a75ce79ff56f14e239c6ad1de Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 1 Oct 2026 20:41:41 +0000 Subject: [PATCH] ci: Add OpenSSF Scorecard analysis Run OpenSSF Scorecard on pushes to master, branch protection changes and a weekly schedule, and upload its SARIF results to code scanning. It reports supply-chain posture this repository cares about: pinned actions, token permissions, branch protection and signed releases. Actions are pinned to full commit SHAs, as in the existing workflows. Permissions are read-only except the job security-events permission for SARIF upload and id-token permission for publishing results to the public Scorecard API. Scorecard runs only on the default branch, so this takes effect once this pull request is merged into master. Claude-Session: https://claude.ai/code/session_013gZvwvuocM7a7Ut4kiBFHw --- .github/workflows/scorecard.yml | 37 +++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..557fe7e --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,37 @@ +name: Scorecard supply-chain security + +on: + branch_protection_rule: + schedule: + - cron: "29 4 * * 1" + push: + branches: [master] + +permissions: + contents: read + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + id-token: write + steps: + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false + - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + with: + results_file: results.sarif + results_format: sarif + publish_results: true + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + with: + sarif_file: results.sarif