name: OpenSSF Scorecard

on:
  branch_protection_rule:
  schedule:
    - cron: '41 7 * * 1'
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: scorecard-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analysis:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Run Scorecard analysis
        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
        with:
          results_file: results.sarif
          results_format: sarif
          publish_results: false

      - name: Upload Scorecard results to code scanning
        uses: github/codeql-action/upload-sarif@85b88275909735f5bc23196090e03d2eb148b3de # v3.32.4
        with:
          sarif_file: results.sarif

      - name: Upload Scorecard results artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: scorecard-results
          path: results.sarif
          retention-days: 5