MegaBites-AI/Windows-powershell

1# This workflow uses actions that are not certified by GitHub. They are provided2# by a third-party and are governed by separate terms of service, privacy3# policy, and support documentation.4 5name: Scorecard supply-chain security6on:7  # For Branch-Protection check. Only the default branch is supported. See8  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection9  branch_protection_rule:10  # To guarantee Maintained check is occasionally updated. See11  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained12  schedule:13    - cron: '20 7 * * 2'14  push:15    branches: ["master"]16 17# Declare default permissions as read only.18permissions: read-all19 20jobs:21  analysis:22    name: Scorecard analysis23    if: github.repository_owner == 'PowerShell'24    runs-on: ubuntu-latest25    permissions:26      # Needed to upload the results to code-scanning dashboard.27      security-events: write28      # Needed to publish results and get a badge (see publish_results below).29      id-token: write30      contents: read31      actions: read32 33    steps:34      - name: "Checkout code"35        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.236        with:37          persist-credentials: false38 39      - name: "Run analysis"40        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.341        with:42          results_file: results.sarif43          results_format: sarif44          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:45          # - you want to enable the Branch-Protection check on a *public* repository, or46          # - you are installing Scorecards on a *private* repository47          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.48          # repo_token: ${{ secrets.SCORECARD_TOKEN }}49 50          # Public repositories:51          #   - Publish results to OpenSSF REST API for easy access by consumers52          #   - Allows the repository to include the Scorecard badge.53          #   - See https://github.com/ossf/scorecard-action#publishing-results.54          # For private repositories:55          #   - `publish_results` will always be set to `false`, regardless56          #     of the value entered here.57          publish_results: true58 59      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF60      # format to the repository Actions tab.61      - name: "Upload artifact"62        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.063        with:64          name: SARIF file65          path: results.sarif66          retention-days: 567 68      # Upload the results to GitHub's code scanning dashboard.69      - name: "Upload to code-scanning"70        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v3.29.571        with:72          sarif_file: results.sarif73