From 1180e26bb85991d5100102d0af17553b7699b7ef Mon Sep 17 00:00:00 2001 From: AnzalKhan16 Date: Fri, 3 Jul 2026 19:29:54 +0530 Subject: [PATCH] feat(ci): add OpenSSF Scorecard security scan workflow Signed-off-by: AnzalKhan16 --- .github/workflows/scorecard.yml | 48 +++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..078be2c --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,48 @@ +name: OpenSSF Scorecard + +on: + branch_protection_rule: + schedule: + - cron: '30 1 * * 1' + workflow_dispatch: + +permissions: + contents: read + +jobs: + analysis: + name: OpenSSF Scorecard Analysis + runs-on: ubuntu-latest + timeout-minutes: 30 + + permissions: + security-events: write + id-token: write + contents: read + actions: read + + steps: + - name: Checkout Repository + uses: actions/checkout@v6 + with: + persist-credentials: false + fetch-depth: 0 + + - name: Run OpenSSF Scorecard + uses: ossf/scorecard-action@v2.4.3 + with: + results_file: results.sarif + results_format: sarif + publish_results: true + + - name: Upload SARIF Results + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: results.sarif + + - name: Upload Scorecard Artifact + uses: actions/upload-artifact@v4 + with: + name: scorecard-results + path: results.sarif + retention-days: 5 \ No newline at end of file