G2 S6: Mac-tail cluster re-capture (live kind stand) (#164) #108
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OpenSSF Scorecard — automated supply-chain security posture assessment. | |
| # | |
| # This is the project's $0 third-party-defined security posture channel: the | |
| # OpenSSF/Google Scorecard heuristics assess this repository and publish a | |
| # citable score + SARIF. It is a POSTURE signal only — NOT a third-party | |
| # penetration-test attestation (backlog item 22 stays N/A / unclaimed). The | |
| # action runs on the default branch, weekly, and whenever a branch-protection | |
| # rule changes; it never gates pull requests. | |
| name: Scorecard supply-chain security | |
| on: | |
| branch_protection_rule: | |
| schedule: | |
| - cron: "30 6 * * 1" | |
| push: | |
| branches: [main] | |
| # Least privilege at the top level; the analysis job opts into the two writes | |
| # it actually needs. | |
| permissions: read-all | |
| concurrency: | |
| group: scorecard-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Upload the result SARIF to the code-scanning dashboard. | |
| security-events: write | |
| # Publish the result to the public OpenSSF registry (OIDC token). | |
| id-token: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: SARIF file | |
| path: results.sarif | |
| retention-days: 5 | |
| if-no-files-found: error | |
| - name: Upload to code-scanning | |
| uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 | |
| with: | |
| sarif_file: results.sarif |