ci(deps): bump cosign-installer to v4.1.2, pin cosign CLI to v2.5.2 (… #95
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OpenSSF Scorecard | |
| # Runs the OpenSSF Scorecard checks against the repo and uploads the results | |
| # to GitHub's code-scanning dashboard. The badge in README is generated from | |
| # https://api.securityscorecards.dev — Scorecard publishes results to its | |
| # public registry when this workflow runs on the default branch. | |
| on: | |
| # Weekly run keeps the score fresh. | |
| schedule: | |
| - cron: '0 5 * * 1' | |
| push: | |
| branches: [master] | |
| workflow_dispatch: | |
| permissions: read-all | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| # Scorecard's action is published for ubuntu-latest only. This job | |
| # analyzes the repo (not the PowerShell code) so the OS doesn't matter. | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Required for uploading results to code-scanning dashboard. | |
| security-events: write | |
| # Required to read repository state. | |
| id-token: write | |
| contents: read | |
| actions: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| # publish_results: write to the public Scorecard registry so the | |
| # badge URL resolves. Requires a public repo, which RackStack is. | |
| publish_results: true | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: SARIF file | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: Upload to code-scanning | |
| uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 | |
| with: | |
| sarif_file: results.sarif |