diff options
| author | Darius Jahandarie <djahandarie@gmail.com> | 2023-10-01 12:43:45 +0900 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-10-01 12:43:45 +0900 |
| commit | 0fbfeb883eb4ca03b9a802757138fef9a6835cdc (patch) | |
| tree | d752d7594d8302f149eb6aa30485a324ab7aa883 /.github/workflows/scorecard.yml | |
| parent | ea1c147730bef183855f5dc079c9a2d19e1c623e (diff) | |
| parent | 0fa8d441a269b13474e6ad4108f49497d4d3abfd (diff) | |
Merge branch 'master' into dependabot/github_actions/cardinalby/schema-validator-action-3.0.0
Diffstat (limited to '.github/workflows/scorecard.yml')
| -rw-r--r-- | .github/workflows/scorecard.yml | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index ac07d2d7..4db56a60 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -16,6 +16,7 @@ permissions: read-all jobs: analysis: name: Scorecard analysis + environment: scorecard runs-on: ubuntu-latest permissions: # Needed to upload the results to code-scanning dashboard. @@ -28,12 +29,12 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 + uses: actions/checkout@v4 with: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@80e868c13c90f172d68d1f4501dee99e2479f7af # v2.1.3 + uses: ossf/scorecard-action@08b4669551908b1024bb425080c797723083c031 # v2.2.0 with: results_file: results.sarif results_format: sarif @@ -41,7 +42,7 @@ jobs: # - you want to enable the Branch-Protection check on a *public* repository, or # - you are installing Scorecard on a *private* repository # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. - # repo_token: ${{ secrets.SCORECARD_TOKEN }} + repo_token: ${{ secrets.SCORECARD_TOKEN }} # Public repositories: # - Publish results to OpenSSF REST API for easy access by consumers @@ -55,7 +56,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0 + uses: actions/upload-artifact@v3 with: name: SARIF file path: results.sarif @@ -63,6 +64,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@04df1262e6247151b5ac09cd2c303ac36ad3f62b # v2.2.9 + uses: github/codeql-action/upload-sarif@a09933a12a80f87b87005513f0abb1494c27a716 # v2.21.4 with: sarif_file: results.sarif |