fix: OpenSSF scorecard generation

darccio · Jun 20, 2023 · 1475161 · 1475161
1 parent 131de81
commit 1475161
Showing 1 changed file with 14 additions and 1 deletion.
diff --git a/.github/workflows/openssf.yml b/.github/workflows/openssf.yml
@@ -5,14 +5,27 @@ on:
       - master
 jobs:
   scorecard:
-    runs-on: ubuntu-latest
     name: OpenSSF
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      actions: read
+      contents: read
+      # Needed to access OIDC token.
+      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3
+        with:
+          persist-credentials: false
       - name: OSSF Scorecard action
         uses: ossf/scorecard-action@v2.1.3
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
+      - name: "Upload SARIF results to code scanning"
+        uses: github/codeql-action/upload-sarif@v2.3.6
+        with:
+          sarif_file: results.sarif