wehub-resource-sync
6e7352b6f7
Docker Tests (Consolidated) / UI Tests (Puppeteer) (push) Blocked by required conditions
Create Release / version-check (push) Has been cancelled
Create Release / release-gate (push) Has been cancelled
Create Release / ci-gate (push) Has been cancelled
Create Release / test-gate (push) Has been cancelled
Create Release / e2e-test-gate (push) Has been cancelled
Create Release / responsive-test-gate (push) Has been cancelled
Create Release / compat-test-gate (push) Has been cancelled
Create Release / compose-integration-gate (push) Has been cancelled
Create Release / vulture-gate (push) Has been cancelled
Create Release / build (push) Has been cancelled
Create Release / provenance (push) Has been cancelled
Create Release / prerelease-docker (push) Has been cancelled
Create Release / publish-docker (push) Has been cancelled
Create Release / create-release (push) Has been cancelled
Create Release / cleanup-changelog (push) Has been cancelled
Create Release / trigger-pypi (push) Has been cancelled
Create Release / monitor-pypi (push) Has been cancelled
Create Release / Clean up orphan prerelease tags and signatures (push) Has been cancelled
Docker Tests (Consolidated) / UI Tests (Puppeteer) [auth-login] (push) Waiting to run
Docker Tests (Consolidated) / LLM Unit Tests (push) Waiting to run
Docker Tests (Consolidated) / LLM Example Tests (push) Waiting to run
Docker Tests (Consolidated) / Infrastructure Tests (push) Waiting to run
OSSF Scorecard / OSSF Security Scorecard Analysis (push) Failing after 0s
OSV-Scanner (Scheduled) / scan-scheduled (push) Failing after 0s
Version Auto-Bump / version-bump (push) Failing after 0s
Backwards Compatibility / Verify Encryption Constants (push) Failing after 1s
Backwards Compatibility / PyPI Version Compatibility (push) Failing after 1s
Backwards Compatibility / Database Migration Tests (push) Failing after 0s
CodeQL Advanced / Analyze (javascript-typescript) (push) Failing after 1s
CodeQL Advanced / Analyze (python) (push) Failing after 1s
Docker Tests (Consolidated) / detect-changes (push) Failing after 1s
Docker Tests (Consolidated) / Build Test Image (push) Failing after 1s
Sync repo labels / sync-labels (push) Failing after 0s
MCP Server Tests / MCP Server Tests (push) Failing after 1s
Docker Tests (Consolidated) / Production Image Smoke Test (push) Waiting to run
Docker Tests (Consolidated) / UI Tests (Puppeteer) [history-news] (push) Waiting to run
Docker Tests (Consolidated) / UI Tests (Puppeteer) [library] (push) Waiting to run
Docker Tests (Consolidated) / UI Tests (Puppeteer) [link-analytics] (push) Waiting to run
Docker Tests (Consolidated) / UI Tests (Puppeteer) [mobile] (push) Waiting to run
Docker Tests (Consolidated) / UI Tests (Puppeteer) [research-form] (push) Waiting to run
Docker Tests (Consolidated) / UI Tests (Puppeteer) [research-metrics] (push) Waiting to run
Docker Tests (Consolidated) / UI Tests (Puppeteer) [research-workflow] (push) Waiting to run
Docker Tests (Consolidated) / UI Tests (Puppeteer) [settings-core] (push) Waiting to run
Docker Tests (Consolidated) / UI Tests (Puppeteer) [settings-pages] (push) Waiting to run
Docker Tests (Consolidated) / UI Tests (Puppeteer) [auth-register] (push) Waiting to run
Docker Tests (Consolidated) / UI Tests (Puppeteer) [chat-core] (push) Waiting to run
Docker Tests (Consolidated) / UI Tests (Puppeteer) [chat-lifecycle] (push) Waiting to run
Docker Tests (Consolidated) / UI Tests (Puppeteer) [error-benchmark] (push) Waiting to run
Docker Tests (Consolidated) / UI Tests (Puppeteer) [auth-pages] (push) Waiting to run
Docker Tests (Consolidated) / Accessibility Tests (push) Waiting to run
Docker Tests (Consolidated) / All Pytest Tests + Coverage (push) Has been skipped
Docker Tests (Consolidated) / UI Tests (Puppeteer) [accessibility] (push) Waiting to run
Docker Tests (Consolidated) / UI Tests (Puppeteer) [api-crud] (push) Waiting to run
63 lines
1.9 KiB
YAML
63 lines
1.9 KiB
YAML
name: OSSF Scorecard
|
|
|
|
on:
|
|
# Run on branches (for analysis purposes)
|
|
branch_protection_rule:
|
|
# Run on schedule
|
|
schedule:
|
|
# Run weekly on Monday at 8 AM UTC
|
|
- cron: '0 8 * * 1'
|
|
# Allow manual runs
|
|
workflow_dispatch:
|
|
# Run on push to default branch
|
|
push:
|
|
branches: [ main ]
|
|
|
|
# Declare default permissions as read only.
|
|
permissions: read-all
|
|
|
|
jobs:
|
|
analysis:
|
|
name: OSSF Security Scorecard Analysis
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
# Needed to upload the results to code-scanning dashboard.
|
|
security-events: write
|
|
# Needed to publish results and get a badge
|
|
id-token: write
|
|
# Needed for private repositories
|
|
contents: read
|
|
actions: read
|
|
|
|
steps:
|
|
- name: Harden the runner (Audit all outbound calls)
|
|
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Checkout repository
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Run OSSF Scorecard analysis
|
|
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
|
|
with:
|
|
results_file: results.sarif
|
|
results_format: sarif
|
|
# Publish results to enable scorecard badges
|
|
publish_results: true
|
|
|
|
- name: Upload OSSF Scorecard results to GitHub Security
|
|
uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
|
|
with:
|
|
sarif_file: results.sarif
|
|
category: ossf-scorecard
|
|
|
|
- name: Upload OSSF Scorecard results as artifact
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: ossf-scorecard-results
|
|
path: results.sarif
|
|
retention-days: 7 # Reduced for security
|