-
Notifications
You must be signed in to change notification settings - Fork 180
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[MNT] Adding Scorecard.yml Workflow and Scorecard Badge GOSST (#1619)
* Create scorecard.yml for continuous fuzzing with OSS-Fuzz Integrating Google's OSS-Fuzz platform. GSoC * Clean scorecard.yml * Add Scorecard Badge to README.md * Update scorecard.yml
- Loading branch information
1 parent
fb557f5
commit 6e5b1d5
Showing
2 changed files
with
51 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| # This workflow uses actions that are not certified by GitHub. They are provided | ||
| # by a third-party and are governed by separate terms of service, privacy | ||
| # policy, and support documentation. | ||
|
|
||
| name: Scorecard supply-chain security | ||
| on: | ||
| branch_protection_rule: | ||
| schedule: | ||
| - cron: '30 1 * * 7' | ||
| push: | ||
| branches: [ "main" ] | ||
|
|
||
| permissions: read-all | ||
|
|
||
| jobs: | ||
| analysis: | ||
| name: Scorecard analysis | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| # Needed to upload the results to code-scanning dashboard. | ||
| security-events: write | ||
| # Needed to publish results and get a badge (see publish_results below). | ||
| id-token: write | ||
|
|
||
| steps: | ||
| - name: "Checkout code" | ||
| uses: actions/checkout@v4 # v4.1.1 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: "Run analysis" | ||
| uses: ossf/scorecard-action@v4.13.1 | ||
| with: | ||
| results_file: results.sarif | ||
| results_format: sarif | ||
| publish_results: true | ||
|
|
||
| # Upload the results as artifacts (optional). | ||
| - name: "Upload artifact" | ||
| uses: actions/upload-artifact@v3 | ||
| with: | ||
| name: SARIF file | ||
| path: results.sarif | ||
| retention-days: 5 | ||
|
|
||
| # Upload the results to GitHub's code scanning dashboard (optional). | ||
| - name: "Upload to code-scanning" | ||
| uses: github/codeql-action/upload-sarif@v2 | ||
| with: | ||
| sarif_file: results.sarif |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters