Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 01:00 UTC
| 1 | # This workflow uses actions that are not certified by GitHub. They are provided |
| 2 | # by a third-party and are governed by separate terms of service, privacy |
| 3 | # policy, and support documentation. |
| 4 | |
| 5 | name: OpenSSF Scorecard supply-chain security |
| 6 | on: |
| 7 | # For Branch-Protection check. Only the default branch is supported. See |
| 8 | # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection |
| 9 | branch_protection_rule: |
| 10 | # To guarantee Maintained check is occasionally updated. See |
| 11 | # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained |
| 12 | schedule: |
| 13 | - cron: '20 2 * * 5' |
| 14 | push: |
| 15 | branches: [ "master", "2.*" ] |
| 16 | pull_request: |
| 17 | branches: [ "master", "2.*" ] |
| 18 | |
| 19 | |
| 20 | # Declare default permissions as read only. |
| 21 | permissions: read-all |
| 22 | |
| 23 | jobs: |
| 24 | analysis: |
| 25 | name: Scorecard analysis |
| 26 | runs-on: ubuntu-latest |
| 27 | # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled. |
| 28 | if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request' |
| 29 | permissions: |
| 30 | # Needed to upload the results to code-scanning dashboard. |
| 31 | security-events: write |
| 32 | # Needed to publish results and get a badge (see publish_results below). |
| 33 | id-token: write |
| 34 | # Uncomment the permissions below if installing in a private repository. |
| 35 | # contents: read |
| 36 | # actions: read |
| 37 | |
| 38 | steps: |
| 39 | - name: Harden the runner (Audit all outbound calls) |
| 40 | uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 |
| 41 | with: |
| 42 | egress-policy: audit |
| 43 | |
| 44 | - name: "Checkout code" |
| 45 | uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
| 46 | with: |
| 47 | persist-credentials: false |
| 48 | |
| 49 | - name: "Run analysis" |
| 50 | uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 |
| 51 | with: |
| 52 | results_file: results.sarif |
| 53 | results_format: sarif |
| 54 | # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: |
| 55 | # - you want to enable the Branch-Protection check on a *public* repository, or |
| 56 | # - you are installing Scorecard on a *private* repository |
| 57 | # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional. |
| 58 | # repo_token: ${{ secrets.SCORECARD_TOKEN }} |
| 59 | |
| 60 | # Public repositories: |
| 61 | # - Publish results to OpenSSF REST API for easy access by consumers |
| 62 | # - Allows the repository to include the Scorecard badge. |
| 63 | # - See https://github.com/ossf/scorecard-action#publishing-results. |
| 64 | # For private repositories: |
| 65 | # - `publish_results` will always be set to `false`, regardless |
| 66 | # of the value entered here. |
| 67 | publish_results: true |
| 68 | |
| 69 | # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore |
| 70 | # file_mode: git |
| 71 | |
| 72 | # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF |
| 73 | # format to the repository Actions tab. |
| 74 | - name: "Upload artifact" |
| 75 | uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 |
| 76 | with: |
| 77 | name: SARIF file |
| 78 | path: results.sarif |
| 79 | retention-days: 5 |
| 80 | |
| 81 | # Upload the results to GitHub's code scanning dashboard (optional). |
| 82 | # Commenting out will disable upload of results to your repo's Code Scanning dashboard |
| 83 | - name: "Upload to code-scanning" |
| 84 | uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v3.29.5 |
| 85 | with: |
| 86 | sarif_file: results.sarif |