scorecard.yml

# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
name: OSSF Scorecard

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  schedule:
    - cron: '0 4 * * *'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  actions: read
  contents: read

jobs:
  scorecard:
    permissions:
      actions: read
      contents: read
      id-token: write
      security-events: write
    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@210f14e753c80064ec1bcae72f1d654dd9b0e687
    secrets: inherit