Repository navigation
Merge pull request #239 from Randomname653/claude/number-locale #177
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OSSF Scorecard — audits the REPO's supply-chain hygiene (workflow token | |
| # permissions, dangerous patterns, pinned deps, SAST/CI presence, Dependabot, | |
| # maintained activity …), not the code. Weekly + on push to main; results in | |
| # the Security tab, score published to the OpenSSF API for the README badge. | |
| # | |
| # Every action here is SHA-pinned (scorecard practices what it preaches — | |
| # its Pinned-Dependencies check will still ding the tag-pinned first-party | |
| # actions in our other workflows; accepted trade-off). Known score dents we | |
| # accept deliberately: Branch-Protection / Code-Review (solo operator | |
| # pushing to main), Fuzzing, Signed-Releases. | |
| name: Scorecard supply-chain security | |
| on: | |
| # For the Branch-Protection check. Only the default branch is supported. | |
| branch_protection_rule: | |
| # Keeps the Maintained check current. | |
| schedule: | |
| - cron: '17 7 * * 6' | |
| push: | |
| branches: [ "main" ] | |
| permissions: read-all | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| # publish_results only works from the default branch. | |
| if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request' | |
| permissions: | |
| # Upload to the code-scanning dashboard. | |
| security-events: write | |
| # Publish results + enable the badge. | |
| id-token: write | |
| steps: | |
| - name: "Checkout code" | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: "Run analysis" | |
| uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| # No repo_token PAT: the Branch-Protection check stays partial on | |
| # purpose — we accept that dent rather than park a write-scoped | |
| # token in the repo secrets. | |
| publish_results: true | |
| - name: "Upload artifact" | |
| uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 | |
| with: | |
| name: SARIF file | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: "Upload to code-scanning" | |
| uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 | |
| with: | |
| sarif_file: results.sarif |