mirror of
https://github.com/angular/angular.git
synced 2026-09-14 13:54:52 +08:00
Charles Lyding
2e7e46f1b6
Renovate supports using hashed version pinning for individual Github actions while still following SemVer-based tags. All workflow actions external to the Angular organization now leverage this support to ensure both that stable versions of the actions are used and that the actions are pinned to a hashed version of the tag. PR Close #45178
50 lines
1.4 KiB
YAML
50 lines
1.4 KiB
YAML
name: OpenSSF Scorecard
|
|
on:
|
|
branch_protection_rule:
|
|
schedule:
|
|
- cron: '0 0 * * 0'
|
|
push:
|
|
branches: [master]
|
|
workflow_dispatch:
|
|
|
|
# Declare default permissions as read only.
|
|
permissions: read-all
|
|
|
|
jobs:
|
|
analysis:
|
|
name: Scorecards analysis
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
# Needed to upload the results to code-scanning dashboard.
|
|
security-events: write
|
|
actions: read
|
|
contents: read
|
|
|
|
steps:
|
|
- name: 'Checkout code'
|
|
uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2.4.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: 'Run analysis'
|
|
uses: ossf/scorecard-action@c1aec4ac820532bab364f02a81873c555a0ba3a1 # renovate: tag=v1.0.4
|
|
with:
|
|
results_file: results.sarif
|
|
results_format: sarif
|
|
repo_token: ${{ secrets.GITHUB_TOKEN }}
|
|
publish_results: true
|
|
|
|
# Upload the results as artifacts.
|
|
- name: 'Upload artifact'
|
|
uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # renovate: tag=v2.3.1
|
|
with:
|
|
name: SARIF file
|
|
path: results.sarif
|
|
retention-days: 5
|
|
|
|
# Upload the results to GitHub's code scanning dashboard.
|
|
- name: 'Upload to code-scanning'
|
|
uses: github/codeql-action/upload-sarif@d39d5d5c9707b926d517b1b292905ef4c03aa777 # renovate: tag=v1.1.2
|
|
with:
|
|
sarif_file: results.sarif
|