From 588239c86ef69b72e9e8ecd0c5e6d5568f0d02b6 Mon Sep 17 00:00:00 2001 From: shenxianpeng Date: Fri, 3 Jul 2026 11:54:20 +0300 Subject: [PATCH] chore: add OpenSSF Scorecard workflow Add a GitHub Actions workflow that runs OpenSSF Scorecard analysis on every push to main and supports manual trigger (workflow_dispatch). The workflow: - Checks out the repo without persisting credentials - Runs ossf/scorecard-action to generate SARIF results - Publishes results to the OpenSSF public API (updates the badge) - Uploads the SARIF file as a build artifact (retained for 5 days) --- .github/workflows/scorecard.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 00000000..1bb8a11e --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,30 @@ +name: OpenSSF Scorecard + +on: + push: + branches: [main] + workflow_dispatch: + +permissions: + id-token: write + contents: read + +jobs: + analysis: + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false + + - uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b757266b50d # v2.4.1 + with: + results_file: results.sarif + results_format: sarif + publish_results: true + + - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1 + with: + name: SARIF file + path: results.sarif + retention-days: 5