Skip to content

Commit ebb07cb

Browse files
committed
chore(ci): replace scorecard.yml with reusable wrapper
Pins to hyperpolymath/standards#205 merge SHA e0caf11508a3989574713c78f5f444f2ce5e33ef. Replaces the canonical scorecard.yml with a thin wrapper. Closes the 5-candidate convergence set (mirror, secret-scanner, codeql, hypatia-scan, scorecard). Part of estate-wide convergence campaign 2026-05-26 (standards#199 / #205).
1 parent 55c80a4 commit ebb07cb

1 file changed

Lines changed: 9 additions & 34 deletions

File tree

.github/workflows/scorecard.yml

Lines changed: 9 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,16 @@
11
# SPDX-License-Identifier: PMPL-1.0-or-later
2-
name: OSSF Scorecard
2+
name: Scorecards supply-chain security
3+
34
on:
4-
push:
5-
branches: [main, master]
5+
branch_protection_rule:
66
schedule:
7-
- cron: '0 4 * * *'
8-
workflow_dispatch:
9-
10-
# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
11-
# updates do not pile up queued runs against the shared account-wide
12-
# Actions concurrency pool. Applied only to read-only check workflows
13-
# (no publish/mutation), so cancelling a superseded run is always safe.
14-
concurrency:
15-
group: ${{ github.workflow }}-${{ github.ref }}
16-
cancel-in-progress: true
7+
- cron: '23 4 * * 1'
8+
push:
9+
branches: [main]
1710

18-
permissions:
19-
contents: read
11+
permissions: read-all
2012

2113
jobs:
2214
analysis:
23-
runs-on: ubuntu-latest
24-
permissions:
25-
security-events: write
26-
id-token: write
27-
steps:
28-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
29-
with:
30-
persist-credentials: false
31-
32-
- name: Run Scorecard
33-
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1
34-
with:
35-
results_file: results.sarif
36-
results_format: sarif
37-
38-
- name: Upload results
39-
uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3.31.8
40-
with:
41-
sarif_file: results.sarif
15+
uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef
16+
secrets: inherit

0 commit comments

Comments
 (0)