diff --git a/.github/workflows/scorecard-scheduler.yaml b/.github/workflows/scorecard-scheduler.yaml new file mode 100644 index 0000000..f89b457 --- /dev/null +++ b/.github/workflows/scorecard-scheduler.yaml @@ -0,0 +1,25 @@ +name: OpenSSF Scorecard Analysis + +on: + push: + branches: [ main ] + +jobs: + run-scorecard: + runs-on: ubuntu-latest + + permissions: + # Needed to upload the results to code-scanning dashboard + security-events: write + # Needed to publish results and get a badge + id-token: write + + steps: + - name: Check out code + uses: actions/checkout@v4 + + - name: Run Scorecard + uses: ossf/scorecard-action@v2.4.0 + with: + results_file: results.json + publish_results: true