Repository navigation
fix(monitor): read the brew tap path from the prefix, not /opt/homebrew #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Scorecard | |
| # OpenSSF Scorecard over this repository's own supply-chain practice: pinned actions, token | |
| # permissions, branch protection, signed releases and the rest. Results go to code scanning as SARIF. | |
| # | |
| # GATED OFF WHILE THE REPOSITORY IS PRIVATE. codeql.yml records that SARIF upload fails here with a | |
| # configuration error because code scanning is unavailable on this private repository, and that | |
| # failing runs are billed. Schedule and push runs therefore skip unless the repository variable | |
| # SCORECARD_ENABLED is 'true'; workflow_dispatch always runs. At publication, set the variable, | |
| # flip publish_results to true and grant the job id-token: write (docs/RELEASE-RUNBOOK.md). | |
| on: | |
| schedule: | |
| - cron: '17 4 * * 1' | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: scorecard-${{ github.event_name }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| analysis: | |
| name: Scorecard analysis | |
| if: github.event_name == 'workflow_dispatch' || vars.SCORECARD_ENABLED == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| # SARIF upload to code scanning | |
| security-events: write | |
| # read the tree and the workflow runs the checks score | |
| contents: read | |
| actions: read | |
| steps: | |
| # Actions pinned to commit SHAs; the trailing comment names the release each SHA was resolved | |
| # from, and bin/pin-actions.mjs verifies them against the upstream tags. | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 | |
| with: | |
| results_file: scorecard.sarif | |
| results_format: sarif | |
| # false while private: the public Scorecard API refuses private repositories. Flip to true | |
| # at publication, together with id-token: write above. | |
| publish_results: false | |
| - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 | |
| with: | |
| name: scorecard-sarif | |
| path: scorecard.sarif | |
| retention-days: 5 | |
| - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 | |
| with: | |
| sarif_file: scorecard.sarif |