Create scorecard.yml

.github/workflows/scorecard.yml

@@ -0,0 +1,50 @@
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '20 19 * * 3'
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'oneapi-src'
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+    steps:
+    - name: "Checkout code"
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: "Run analysis"
+      uses: ossf/scorecard-action@v2.3.3
+      with:
+        results_file: results.sarif
+        results_format: sarif
+        # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+        # - you want to enable the Branch-Protection check on a *public* repository, or
+        # - you are installing Scorecard on a *private* repository
+        # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+        # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+        publish_results: true
+    - name: "Upload artifact"
+      uses: actions/upload-artifact@v3
+      with:
+        name: SARIF file
+        path: results.sarif
+    - name: "Upload to code-scanning"
+      if: github.event_name != 'pull_request'
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: results.sarif