Repository navigation

Scorecard #26

	# OpenSSF Scorecard — supply chain security assessment.
	#
	# Runs weekly + on push to main. Publishes results to:
	# - GitHub Code Scanning (Security tab → SARIF)
	# - OpenSSF public dashboard (enables README badge)
	#
	# See: https://securityscorecards.dev

	name: Scorecard

	on:
	push:
	branches: [main]
	schedule:
	# Weekly on Mondays at 01:30 UTC
	- cron: "30 1 * * 1"

	# Required by Scorecard: no top-level permissions beyond what jobs declare.
	permissions: {}

	jobs:
	analysis:
	name: Scorecard analysis
	runs-on: ubuntu-24.04
	permissions:
	security-events: write # Upload SARIF to Code Scanning
	id-token: write # OIDC for publishing results
	contents: read
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false

	- uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
	with:
	results_file: results.sarif
	results_format: sarif
	publish_results: true

	- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: scorecard-sarif
	path: results.sarif
	retention-days: 5

	- uses: github/codeql-action/upload-sarif@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3.36.3
	with:
	sarif_file: results.sarif