feat(cli): doctor says what retention is on an object, not only what … #79
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OpenSSF Scorecard, published to the Scorecard API and the Security tab. | |
| name: scorecard | |
| on: | |
| branch_protection_rule: | |
| schedule: | |
| - cron: '20 7 * * 2' # Tuesdays 07:20 UTC | |
| workflow_dispatch: # so a run can be kicked off without inventing a commit | |
| push: | |
| branches: [main] | |
| permissions: {} | |
| jobs: | |
| analysis: | |
| name: scorecard analysis | |
| runs-on: ubuntu-latest | |
| # A job-level block replaces the workflow-level one, so every scope Scorecard | |
| # needs is listed here. The reads are what its checks query, without them the | |
| # checkout of a private repo 404s and several checks score blind. | |
| permissions: | |
| security-events: write # upload the SARIF result | |
| id-token: write # publish results to the Scorecard API | |
| contents: read # checkout | |
| actions: read # upload-sarif reads the run it is attaching to | |
| issues: read # maintained / code-review checks | |
| pull-requests: read # code-review check | |
| checks: read # ci-tests check | |
| steps: | |
| # Deny egress by default; see ci.yml. Scorecard queries deps.dev / OSV / the OpenSSF | |
| # best-practices API for its checks, and signs its published result through Sigstore. | |
| - name: Harden the runner | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.deps.dev:443 | |
| api.github.com:443 | |
| api.osv.dev:443 | |
| api.scorecard.dev:443 | |
| fulcio.sigstore.dev:443 | |
| github.com:443 | |
| oss-fuzz-build-logs.storage.googleapis.com:443 | |
| rekor.sigstore.dev:443 | |
| tuf-repo-cdn.sigstore.dev:443 | |
| www.bestpractices.dev:443 | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run Scorecard | |
| uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: scorecard-results | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: Upload to code scanning | |
| uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 | |
| with: | |
| sarif_file: results.sarif |