1# Copyright 2023 Google LLC
2#
3# Licensed under the Apache License, Version 2.0 (the "License");
4# you may not use this file except in compliance with the License.
5# You may obtain a copy of the License at
6#
7# http://www.apache.org/licenses/LICENSE-2.0
8#
9# Unless required by applicable law or agreed to in writing, software
10# distributed under the License is distributed on an "AS IS" BASIS,
11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12# See the License for the specific language governing permissions and
13# limitations under the License.
14
15name: OSSF Scorecard
16on:
17 # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
18 branch_protection_rule:
19 schedule:
20 # weekly on Sunday
21 - cron: '0 20 * * 0'
22 push:
23 branches: [ "main" ]
24
25# Declare default permissions as read only.
26permissions: read-all
27
28jobs:
29 analysis:
30 name: Scorecard analysis
31 runs-on: ubuntu-latest
32 permissions:
33 # Needed to upload the results to code-scanning dashboard.
34 security-events: write
35
36 steps:
37 - name: "Checkout code"
38 uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
39 with:
40 persist-credentials: false
41
42 - name: "Run analysis"
43 uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
44 with:
45 results_file: results.sarif
46 results_format: sarif
47
48 - name: Filter SARIF to skip false positives
49 # filter out DangerousWorkflow alerts as they do not account for safe use of labels to trigger actions
50 env:
51 SCORECARD_SKIPPED_RULE_IDS: "DangerousWorkflowID"
52 run: |
53 SCORECARD_SKIPPED_RULE_IDS_JSON=$(echo $SCORECARD_SKIPPED_RULE_IDS | jq -cR 'split(",")')
54 # Trim the SARIF file to remove false positive detections
55 cat results.sarif | jq '.runs[].results |= map(select(.ruleId as $id | '$SCORECARD_SKIPPED_RULE_IDS_JSON' | all($id != .)))' > resultsFiltered.sarif
56
57 # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
58 # format to the repository Actions tab.
59 - name: "Upload artifact"
60 uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
61 with:
62 name: SARIF file
63 path: results.sarif
64 retention-days: 5
65
66 # Upload the results to GitHub's code scanning dashboard.
67 - name: "Upload to code-scanning"
68 uses: github/codeql-action/upload-sarif@b7cec7526559c32f1616476ff32d17ba4c59b2d6 # v3.25.5
69 with:
70 sarif_file: resultsFiltered.sarif
View as plain text