mirror of
https://github.com/mermaid-js/mermaid.git
synced 2025-01-28 07:03:17 +08:00
09e0de6053
Verified that the other hash was infact valid and in the repo, but the scorecard action was not picking it up.
38 lines
1.1 KiB
YAML
38 lines
1.1 KiB
YAML
name: Scorecard supply-chain security
|
|
on:
|
|
branch_protection_rule:
|
|
push:
|
|
branches:
|
|
- develop
|
|
schedule:
|
|
- cron: 29 15 * * 0
|
|
permissions: read-all
|
|
jobs:
|
|
analysis:
|
|
name: Scorecard analysis
|
|
permissions:
|
|
id-token: write
|
|
security-events: write
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
|
|
with:
|
|
persist-credentials: false
|
|
- name: Run analysis
|
|
uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
|
|
with:
|
|
results_file: results.sarif
|
|
results_format: sarif
|
|
publish_results: true
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
|
|
with:
|
|
name: SARIF file
|
|
path: results.sarif
|
|
retention-days: 5
|
|
- name: Upload to code-scanning
|
|
uses: github/codeql-action/upload-sarif@c36620d31ac7c881962c3d9dd939c40ec9434f2b # v3.26.12
|
|
with:
|
|
sarif_file: results.sarif
|