From c6b21b7550c55080e254565f68946b2bc5f17ec2 Mon Sep 17 00:00:00 2001 From: Lisanna Dettwyler Date: Mon, 24 Jun 2024 10:36:28 -0400 Subject: [PATCH 1/3] Create scorecard.yml --- .github/workflows/scorecard.yml | 47 +++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 00000000..2c2b5764 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,47 @@ +on: + # For Branch-Protection check. Only the default branch is supported. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection + branch_protection_rule: + # To guarantee Maintained check is occasionally updated. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained + schedule: + - cron: '20 19 * * 3' + push: + branches: [ "master" ] + +permissions: read-all + +jobs: + analysis: + runs-on: ubuntu-latest + if: github.repository_owner == 'oneapi-src' + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + # Needed to publish results and get a badge (see publish_results below). + id-token: write + steps: + - name: "Checkout code" + uses: actions/checkout@v4 + with: + persist-credentials: false + - name: "Run analysis" + uses: ossf/scorecard-action@v2 + with: + results_file: results.sarif + results_format: sarif + # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: + # - you want to enable the Branch-Protection check on a *public* repository, or + # - you are installing Scorecard on a *private* repository + # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional. + # repo_token: ${{ secrets.SCORECARD_TOKEN }} + publish_results: true + - name: "Upload artifact" + uses: actions/upload-artifact@v3 + with: + name: SARIF file + path: results.sarif + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: results.sarif From 1f443ed2b4600c0d09eb2439d5006e44ea593d21 Mon Sep 17 00:00:00 2001 From: Lisanna Dettwyler Date: Mon, 24 Jun 2024 10:43:55 -0400 Subject: [PATCH 2/3] add pull request trigger --- .github/workflows/scorecard.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 2c2b5764..a4c0a39c 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -8,6 +8,8 @@ on: - cron: '20 19 * * 3' push: branches: [ "master" ] + pull_request: + branches: [ "master" ] permissions: read-all @@ -42,6 +44,7 @@ jobs: name: SARIF file path: results.sarif - name: "Upload to code-scanning" + if: github.event_name != 'pull_request' uses: github/codeql-action/upload-sarif@v3 with: sarif_file: results.sarif From 12eabf4c905bc5d8a10ae3a017a8071108915690 Mon Sep 17 00:00:00 2001 From: Lisanna Dettwyler Date: Mon, 24 Jun 2024 10:47:05 -0400 Subject: [PATCH 3/3] fix action version --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index a4c0a39c..25df0ce4 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -28,7 +28,7 @@ jobs: with: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@v2 + uses: ossf/scorecard-action@v2.3.3 with: results_file: results.sarif results_format: sarif