forked from fportantier/vulpy
-
Notifications
You must be signed in to change notification settings - Fork 1
42 lines (36 loc) · 1.08 KB
/
scorecard-dependency.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
name: scorecard-dependency-analysis
on:
pull_request_target:
types:
- opened
- synchronize
- reopened
permissions:
pull-requests: write
jobs:
dependency-analysis:
name: Scorecards dependency analysis
runs-on: ubuntu-latest
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
steps:
- name: Harden Runner
uses: step-security/harden-runner@128a63446a954579617e875aaab7d2978154e969 # v2.4.0
with:
egress-policy: audit
- name: Checkout code
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
with:
persist-credentials: false
- name: Print environment variables
run: |
echo "GITHUB_PR_NUMBER: $GITHUB_PR_NUMBER"
echo $GITHUB_REPOSITORY
echo $GITHUB_SHA
echo $GITHUB_REPOSITORY_OWNER
echo $GITHUB_ACTOR
shell: bash
- name: Run analysis
uses: ossf/scorecard-dependencyanalysis@dependency-analysis # dependency-analysis
with:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}