From 38b1274702be19a6552edcf767ac527590de87ee Mon Sep 17 00:00:00 2001 From: Rob Bos Date: Mon, 27 Mar 2023 22:22:10 +0200 Subject: [PATCH] Update ossf-analysis.yml --- .github/workflows/ossf-analysis.yml | 48 +++-------------------------- 1 file changed, 4 insertions(+), 44 deletions(-) diff --git a/.github/workflows/ossf-analysis.yml b/.github/workflows/ossf-analysis.yml index 157a9986..d8ce3352 100644 --- a/.github/workflows/ossf-analysis.yml +++ b/.github/workflows/ossf-analysis.yml @@ -1,63 +1,23 @@ -name: Scorecards supply-chain security +name: Scorecards supply-chain security scan on: # Only the default branch is supported. branch_protection_rule: schedule: # Weekly on Saturdays. - - cron: '30 1 * * 6' + - cron: '34 1 * * 6' push: branches: main workflow_dispatch: -# Declare default GITHUB_TOKEN permissions as read only. +# Declare default GITHUB_TOKEN permissions as read only. permissions: read-all jobs: analysis: - name: Scorecards analysis - runs-on: ubuntu-latest + uses: devops-actions/.github/.github/workflows/rw-ossf-scorecard.yml@main permissions: # Needed to upload the results to code-scanning dashboard. security-events: write - # Used to receive a badge. (Upcoming feature) id-token: write actions: read contents: read - - steps: - - name: "Checkout code" - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3.0.0 - with: - persist-credentials: false - - - name: "Run analysis" - uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # tag=v2.1.2 - with: - results_file: results.sarif - results_format: sarif - # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: - # - you want to enable the Branch-Protection check on a *public* repository, or - # - you are installing Scorecards on a *private* repository - # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. - # repo_token: ${{ secrets.SCORECARD_TOKEN }} - - # Publish the results for public repositories to enable scorecard badges. For more details, see - # https://github.com/ossf/scorecard-action#publishing-results. - # For private repositories, `publish_results` will automatically be set to `false`, regardless - # of the value entered here. - publish_results: true - - # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF - # format to the repository Actions tab. - - name: "Upload artifact" - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # tag=v3.0.0 - with: - name: SARIF file - path: results.sarif - retention-days: 7 - - # Upload the results to GitHub's code scanning dashboard. - - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@32dc499307d133bb5085bae78498c0ac2cf762d5 # tag=v1.0.26 - with: - sarif_file: results.sarif \ No newline at end of file