scorecard.yml

# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
name: Scorecard

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '0 0 * * 0'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Must cover everything scorecard-reusable's job requests (see codeql.yml).
# id-token: write is the OIDC token Scorecard uses to publish results;
# security-events: write uploads the SARIF.
permissions:
  contents: read

jobs:
  scorecard:
    permissions:
      actions: read
      contents: read
      security-events: write
      id-token: write
    uses: ./.github/workflows/scorecard-reusable.yml