Merge pull request #823 from rossoctl/fix/inference-parser-vless-paths #352
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OpenSSF Scorecard - Security health metrics for Open Source | |
| # | |
| # Measures repository security posture and provides recommendations. | |
| # Results are uploaded to GitHub Security tab and OpenSSF Scorecard API. | |
| # | |
| # NOTE: Scorecard only works on 'schedule' and 'push' triggers, NOT 'pull_request' | |
| # See: https://github.com/ossf/scorecard-action#workflow-restrictions | |
| # | |
| name: OpenSSF Scorecard | |
| on: | |
| schedule: | |
| - cron: '30 6 * * 1' # Weekly Monday 6:30 AM UTC | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: {} | |
| jobs: | |
| scorecard: | |
| name: Scorecard Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| id-token: write | |
| contents: read | |
| actions: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run Scorecard | |
| uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 | |
| with: | |
| results_file: scorecard.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - name: Upload SARIF to Security tab | |
| uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4 | |
| with: | |
| sarif_file: scorecard.sarif | |
| - name: Upload Scorecard results as artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: scorecard-results | |
| path: scorecard.sarif | |
| retention-days: 30 |