chore(deps): update actions/checkout action to v7.0.1 (#318) #144
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OpenSSF Scorecard — automated supply-chain security checks. | |
| # | |
| # Adopted 2026-06-16. Scorecard is a drop-in Action that grades the | |
| # supply-chain hygiene Margine already practises (SHA-pinned actions, | |
| # least-privilege workflow tokens, cosign-by-digest signed releases, | |
| # Renovate dependency updates). It publishes a 0-10 score to the OpenSSF | |
| # REST API (which backs the README badge) and uploads SARIF to GitHub | |
| # code-scanning. | |
| # | |
| # Expect LOW marks on Branch-Protection / Code-Review / CI-Tests-need- | |
| # reviewers: those score multi-maintainer practices a single-maintainer | |
| # personal project cannot satisfy — that is expected, not a regression. | |
| # Read the high-signal checks instead: Pinned-Dependencies, | |
| # Token-Permissions, Dangerous-Workflow, Dependency-Update-Tool, | |
| # Signed-Releases — Margine should score very well on those. | |
| # | |
| # Uses a third-party action (ossf/scorecard-action), SHA-pinned like every | |
| # other action in this repo (the tj-actions/changed-files lesson). | |
| name: Scorecard supply-chain security | |
| on: | |
| # For the Branch-Protection check. Only the default branch is supported. | |
| branch_protection_rule: | |
| # Keep the Maintained check fresh. | |
| schedule: | |
| - cron: '43 13 * * 2' | |
| push: | |
| branches: [main] | |
| # Declare default permissions as read only. | |
| permissions: read-all | |
| concurrency: | |
| group: scorecard-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-24.04 | |
| # publish_results only works when run from the default branch. | |
| if: github.event.repository.default_branch == github.ref_name | |
| permissions: | |
| # Upload the results to the code-scanning dashboard. | |
| security-events: write | |
| # Publish results to the OpenSSF REST API and get the badge. | |
| id-token: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| # Publish to the OpenSSF REST API so the repo can show the badge. | |
| publish_results: true | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: SARIF file | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: Upload to code-scanning | |
| uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4 | |
| with: | |
| sarif_file: results.sarif |