node-auth0/.github/workflows/scorecard.yml at 851fba189bbdaada4a244612eda91ed4ebd79534 · auth0/node-auth0 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
name: Scorecard analysis

# Runs OpenSSF Scorecard supply-chain analysis directly via ossf/scorecard-action
# (no composite wrapper, no cross-org dependency). All action refs are SHA-pinned.
#
# Scorecard requirements
# ──────────────────────
# • Must run on push to the default branch or a schedule event — NOT pull_request.
#   The if: condition below enforces this.
# • The checkout step MUST set persist-credentials: false (required by Scorecard's
#   security model to avoid leaking the GITHUB_TOKEN into the analysis environment).
# • publish_results: true publishes to the public Scorecard API and enables the
#   Scorecard badge. It requires id-token: write on the job AND a push/schedule
#   event (not a PR). Set to 'false' to keep results private (id-token can then
#   be omitted from the job permissions).

on:
  push:
    branches: [main]
  schedule:
    - cron: '30 1 * * 6'   # weekly, Saturday 01:30 UTC

permissions: read-all   # default: restrict everything; the job overrides what it needs

jobs:
  analysis:
    name: Scorecard analysis
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request'   # Scorecard must run on push/schedule only
    permissions:
      security-events: write   # upload SARIF to the Security tab / Code Scanning dashboard
      id-token: write           # OIDC token for Scorecard's public API publishing (publish_results: true)
                                # Remove this line if you set publish_results: false
      contents: read            # checkout the repository

    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false   # required by Scorecard — do not remove

      - name: Run analysis
        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
        with:
          results_file: results.sarif
          results_format: sarif
          # publish_results: true publishes to the Scorecard public dataset and enables the badge.
          # Requires id-token: write above and a push/schedule event.
          # Set to 'false' (and remove id-token: write) to keep results private.
          publish_results: true

      # Upload SARIF as a workflow artifact (optional — comment out to disable).
      # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: SARIF file
          path: results.sarif
          retention-days: 5

      # Upload SARIF to GitHub Code Scanning dashboard (optional — comment out to disable).
      - name: Upload to code-scanning
        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
        with:
          sarif_file: results.sarif
          category: scorecard

      - name: Result
        if: always()
        shell: bash
        run: |
          if [ "${{ job.status }}" = "success" ]; then
            echo "::notice title=Scorecard::✅ OpenSSF Scorecard analysis complete — results uploaded to Security tab."
          else
            echo "::error title=Scorecard::❌ OpenSSF Scorecard analysis failed."
          fi