chore: session-infra hardening — command-guard hook (pkill -f/force-p… #496

	name: Scorecard analysis workflow

	# Official ossf/scorecard template (goal 0028), adapted only for this
	# repo's SHA-pinning style (matches ci.yml/release.yml's pinned
	# actions/checkout and actions/upload-artifact versions, rather than the
	# template's own independently-pinned SHAs, which happened to already
	# match here). publish_results: true opts into the public score at
	# https://scorecard.dev, which is what makes the README badge live.
	on:
	push:
	# Only the default branch is supported by Scorecard's own docs.
	branches:
	- main
	schedule:
	# Weekly, Saturdays -- matches the upstream template's cadence.
	- cron: '30 1 * * 6'

	permissions: read-all

	jobs:
	analysis:
	name: Scorecard analysis
	runs-on: ubuntu-latest
	permissions:
	# Needed for Code scanning upload.
	security-events: write
	# Needed for GitHub OIDC token, required by publish_results: true.
	id-token: write

	steps:
	- name: 'Checkout code'
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: 'Run analysis'
	uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
	with:
	results_file: results.sarif
	results_format: sarif
	publish_results: true

	- name: 'Upload artifact'
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: SARIF file
	path: results.sarif
	retention-days: 5

	- name: 'Upload to code-scanning'
	uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
	with:
	sarif_file: results.sarif

Navigation Menu