Scorecard supply-chain security #91

	name: Scorecard supply-chain security
	on:
	branch_protection_rule:

	schedule:
	# Run at 5:07 on Mondays
	- cron: '7 5 * * 1'

	# Disabled because it's segfaulting
	# push:
	# branches: [ "main" ]

	permissions: read-all

	jobs:
	analysis:
	name: Scorecard analysis
	runs-on: ubuntu-22.04
	permissions:
	security-events: write
	id-token: write

	steps:
	- name: "Checkout code"
	uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
	with:
	persist-credentials: false

	- name: "Run analysis"
	uses: ossf/scorecard-action@80e868c13c90f172d68d1f4501dee99e2479f7af # v2.1.3
	with:
	results_file: results.sarif
	results_format: sarif
	publish_results: true

	- name: "Upload artifact"
	uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
	with:
	name: SARIF file
	path: results.sarif
	retention-days: 5

	- name: "Upload to code-scanning"
	uses: github/codeql-action/upload-sarif@807578363a7869ca324a79039e6db9c843e0e100 # v2.1.27
	with:
	sarif_file: results.sarif

Provide feedback