kc3-lang/libevent/.github/workflows/scorecard.yml

• Show log

  Commit

• Hash : aa04ba93
  Author :
  Date : 2024-09-01T14:27:50
  

  build(deps): bump github/codeql-action in the github-actions group
  
  Bumps the github-actions group with 1 update: [github/codeql-action](https://github.com/github/codeql-action).
  
  
  Updates `github/codeql-action` from 3.25.15 to 3.26.6
  - [Release notes](https://github.com/github/codeql-action/releases)
  - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
  - [Commits](https://github.com/github/codeql-action/compare/afb54ba388a7dca6ecae48f608c4ff05ff4cc77a...4dd16135b69a43b6c8efb853346f8437d92d3c93)
  
  ---
  updated-dependencies:
  - dependency-name: github/codeql-action
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: github-actions
  ...
  
  Signed-off-by: dependabot[bot] <support@github.com>

Download

• .github/workflows/scorecard.yml

• name: Scorecard supply-chain security
  on:
    # For Branch-Protection check. Only the default branch is supported. See
    # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
    branch_protection_rule:
    # To guarantee Maintained check is occasionally updated. See
    # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
    schedule:
      - cron: '38 3 * * 5'
    push:
      branches: [ "master" ]
  
  # Declare default permissions as read only.
  permissions: read-all
  
  jobs:
    analysis:
      name: Scorecard analysis
      runs-on: ubuntu-latest
      permissions:
        # Needed to upload the results to code-scanning dashboard.
        security-events: write
        # Needed to publish results and get a badge (see publish_results below).
        id-token: write
  
      steps:
        - name: "Checkout code"
          uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
          with:
            persist-credentials: false
  
        - name: "Run analysis"
          uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
          with:
            results_file: results.sarif
            results_format: sarif
  
            # Publish results to OpenSSF REST API for easy access by consumers and allows the repository to include the Scorecard badge.
            # See https://github.com/ossf/scorecard-action#publishing-results
            publish_results: true
  
        # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
        # format to the repository Actions tab.
        - name: "Upload artifact"
          uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
          with:
            name: SARIF file
            path: results.sarif
            retention-days: 5
  
        # Upload the results to GitHub's code scanning dashboard.
        - name: "Upload to code-scanning"
          uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
          with:
            sarif_file: results.sarif
  

Download