mirror of
https://github.com/krkn-chaos/krkn.git
synced 2026-09-08 09:47:17 +00:00
Paige PattonandClaude Sonnet 4.6
9989fe9b21
GITHUB_TOKEN cannot read classic branch protection rules regardless of workflow permissions. Pass a fine-grained PAT (SCORECARD_TOKEN secret) with Administration:read so the Branch-Protection check can run without the 'internal error: some github tokens can't read classic branch protection rules' error. Ref: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-off-by: Paige Patton <prubenda@redhat.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
66 lines
2.8 KiB
YAML
66 lines
2.8 KiB
YAML
name: Scorecard analysis workflow
|
|
on:
|
|
workflow_dispatch: # For Branch-Protection check. Only the default branch is supported. See
|
|
|
|
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
|
|
branch_protection_rule: # To guarantee Maintained check is occasionally updated. See
|
|
|
|
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
|
|
schedule:
|
|
- cron: "30 19 * * *"
|
|
|
|
permissions: read-all
|
|
|
|
jobs:
|
|
analysis:
|
|
name: Scorecard analysis
|
|
runs-on: ubuntu-latest
|
|
# `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
|
|
if: github.event.repository.default_branch == github.ref_name ||
|
|
github.event_name == 'pull_request'
|
|
permissions:
|
|
# Needed for Code scanning upload
|
|
security-events: write
|
|
# Needed for GitHub OIDC token if publish_results is true
|
|
id-token: write
|
|
|
|
steps:
|
|
- name: "Checkout code"
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: "Run analysis"
|
|
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
|
|
with:
|
|
results_file: results.sarif
|
|
results_format: sarif
|
|
# Scorecard team runs a weekly scan of public GitHub repos,
|
|
# see https://github.com/ossf/scorecard#public-data.
|
|
# Setting `publish_results: true` helps us scale by leveraging your workflow to
|
|
# extract the results instead of relying on our own infrastructure to run scans.
|
|
# And it's free for you!
|
|
publish_results: true
|
|
# Fine-grained PAT with Administration:read is required so Scorecard can read
|
|
# classic branch protection rules. GITHUB_TOKEN cannot access these regardless
|
|
# of workflow permissions. See:
|
|
# https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
|
|
repo_token: ${{ secrets.SCORECARD_TOKEN }}
|
|
|
|
# Upload the results as artifacts (optional). Commenting out will disable
|
|
# uploads of run results in SARIF format to the repository Actions tab.
|
|
# https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
|
|
- name: "Upload artifact"
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: SARIF file
|
|
path: results.sarif
|
|
retention-days: 5
|
|
|
|
# Upload the results to GitHub's code scanning dashboard (optional).
|
|
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
|
|
- name: "Upload to code-scanning"
|
|
uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
|
|
with:
|
|
sarif_file: results.sarif
|