scorecards.yml

name: Scorecard Analysis Workflow

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  schedule:
    # Weekly on Saturdays.
    - cron: '30 1 * * 6'

permissions: {}

jobs:
  analysis:
    permissions:
      # Needed if using Code scanning alerts
      security-events: write
      # Needed for GitHub OIDC token if publish_results is true
      id-token: write
      # Needed for nested workflow
      actions: read
      attestations: read
      checks: read
      contents: read
      deployments: read
      issues: read
      discussions: read
      packages: read
      pages: read
      pull-requests: read
      repository-projects: read
      statuses: read

    uses: bytemare/workflows/.github/workflows/scorecard.yml@12c66a077ea4bf80f077cc12348147b066386bb3
    secrets:
      token: ${{ secrets.SCORECARD_TOKEN }}