From 494a0520e6129e5a33f8a10c896eb1e2c2ef0934 Mon Sep 17 00:00:00 2001
From: Lisanna Dettwyler <lisanna.dettwyler@intel.com>
Date: Mon, 24 Jun 2024 11:16:58 -0400
Subject: [PATCH] Create scorecard.yml (#158)

---
 .github/workflows/scorecard.yml | 50 +++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 .github/workflows/scorecard.yml

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 0000000..25df0ce
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,50 @@
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '20 19 * * 3'
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'oneapi-src'
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+    steps:
+    - name: "Checkout code"
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: "Run analysis"
+      uses: ossf/scorecard-action@v2.3.3
+      with:
+        results_file: results.sarif
+        results_format: sarif
+        # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+        # - you want to enable the Branch-Protection check on a *public* repository, or
+        # - you are installing Scorecard on a *private* repository
+        # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+        # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+        publish_results: true
+    - name: "Upload artifact"
+      uses: actions/upload-artifact@v3
+      with:
+        name: SARIF file
+        path: results.sarif
+    - name: "Upload to code-scanning"
+      if: github.event_name != 'pull_request'
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: results.sarif