scorecard.yml

# OpenSSF Scorecard.
#
# Split out of release.yml (2026-08-23): ossf/scorecard-action refuses to
# analyze anything but the repository's default branch. Pushing the first
# real v0.2.0 tag failed this job with "Only the default branch main is
# supported," even though the sbom, sign, and release jobs it sat beside in
# release.yml all passed. The upstream template
# (https://github.com/ossf/scorecard/blob/main/.github/workflows/scorecard-analysis.yml)
# triggers on push to the default branch plus a weekly schedule, never on a
# tag; this file follows that template instead of the tag-triggered one that
# failed.

name: scorecard

on:
  push:
    branches: ["main"]
  schedule:
    # Weekly, Saturdays — the upstream template's own cadence.
    - cron: "30 1 * * 6"
  workflow_dispatch: # exercise the pipeline without waiting for the schedule

permissions:
  contents: read

jobs:
  scorecard:
    name: OpenSSF Scorecard
    runs-on: ubuntu-latest
    permissions:
      # Scorecard's own documented minimum: read the repo, write the SARIF
      # upload to code scanning, and mint the OIDC token its own signing of
      # the results needs.
      contents: read
      security-events: write
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Run analysis
        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
        with:
          results_file: scorecard-results.sarif
          results_format: sarif
          publish_results: true

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: scorecard-results
          path: scorecard-results.sarif
          if-no-files-found: error

      - name: Upload to code scanning
        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
        with:
          sarif_file: scorecard-results.sarif