probe: find why the scorecard workflow has never started #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Sudo Apt Holdings LLC | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # | |
| # OpenSSF Scorecard. It measures this repository against the OpenSSF's own checks - branch | |
| # protection, pinned dependencies, signed releases, dangerous workflow patterns, token | |
| # permissions, maintenance and the rest - and publishes the result so that anyone evaluating the | |
| # project can read it without being asked to trust a claim made here. | |
| # | |
| # It runs weekly rather than on every push because the checks are about the repository's | |
| # configuration and history, which change slowly, and because the analysis reads the GitHub API | |
| # rather than the tree. The results are uploaded to the code-scanning dashboard, so a regression | |
| # in the repository's posture is visible in the same place as a code finding. | |
| name: probe-b | |
| on: | |
| branch_protection_rule: | |
| schedule: | |
| # Mondays, 07:00 UTC. A fixed day makes a drop in the score attributable to the week it | |
| # appeared in rather than to an unknown point since the last look. | |
| - cron: '0 7 * * 1' | |
| push: | |
| branches: ['probe/scorecard-startup'] | |
| permissions: read-all | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Upload the result to the code-scanning dashboard. | |
| security-events: write | |
| # Read the repository's own metadata (branch protection, releases, workflow runs). | |
| id-token: write | |
| contents: read | |
| actions: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| # Publishing makes the score readable at deps.dev and through the Scorecard API, which | |
| # is the point: an evaluator should be able to check the posture without asking us. | |
| publish_results: true | |
| - name: Upload the result as an artifact | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: scorecard-results | |
| path: results.sarif | |
| retention-days: 30 | |