From 586d340f69a5d60ee525ae206078679fbaf56567 Mon Sep 17 00:00:00 2001 From: aidenbrown Date: Thu, 28 May 2026 13:42:07 -0400 Subject: [PATCH 1/3] Add OpenSSF Scorecard workflow --- .github/workflows/scorecard.yml | 36 +++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..8ef76a4 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,36 @@ +name: Scorecard + +on: + workflow_dispatch: + pull_request: + push: + branches: + -main + +permissions: read-all + +jobs: + scorecard: + name: Run OpenSSF Scorecard + runs-on: ubuntu-latest + + permissions: + contents: read + security-events: write + id-token: write + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Run OpenSSF Scorecard + uses: ossf/scorecard-action@v2.4.0 + with: + results_file: results.sarif + results_format: sarif + publish_results: false + + - name: Upload Scorecard results to code scanning + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: results.sarif \ No newline at end of file From e3763519b1637e7a06f0ed6f7264acb4c1ae78c1 Mon Sep 17 00:00:00 2001 From: aidenbrown Date: Thu, 28 May 2026 13:44:35 -0400 Subject: [PATCH 2/3] Fix Scorecard SARIF upload permissions --- .github/workflows/scorecard.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 8ef76a4..3bea815 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -5,7 +5,7 @@ on: pull_request: push: branches: - -main + - main permissions: read-all @@ -15,6 +15,7 @@ jobs: runs-on: ubuntu-latest permissions: + actions: read contents: read security-events: write id-token: write @@ -31,6 +32,6 @@ jobs: publish_results: false - name: Upload Scorecard results to code scanning - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: results.sarif \ No newline at end of file From 9913d12ef55b6ab913695880575177a4c8f605b3 Mon Sep 17 00:00:00 2001 From: aidenbrown Date: Thu, 28 May 2026 13:46:30 -0400 Subject: [PATCH 3/3] Save Scorecard results as workflow artifact --- .github/workflows/scorecard.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 3bea815..c8784c5 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -15,9 +15,7 @@ jobs: runs-on: ubuntu-latest permissions: - actions: read contents: read - security-events: write id-token: write steps: @@ -27,11 +25,12 @@ jobs: - name: Run OpenSSF Scorecard uses: ossf/scorecard-action@v2.4.0 with: - results_file: results.sarif - results_format: sarif + results_format: json + results_file: results.json publish_results: false - - name: Upload Scorecard results to code scanning - uses: github/codeql-action/upload-sarif@v4 + - name: Upload Scorecard artifact + uses: actions/upload-artifact@v4 with: - sarif_file: results.sarif \ No newline at end of file + name: scorecard-results + path: results.json \ No newline at end of file