Skip to content

Commit 85bdcde

Browse files
sxdmnencia
sxd
and
mnencia
authored
chore: add OpenSSF baseline scanner GitHub action (#10054)
Integrate the OpenSSF Baseline Scanner GitHub Action into our pipeline to ensure the workflow returns zero failures. Closes #10060 Signed-off-by: Jonathan Gonzalez V. <[email protected]> Signed-off-by: Marco Nenciarini <[email protected]> Co-authored-by: Marco Nenciarini <[email protected]>
1 parent 2b16f14 commit 85bdcde

1 file changed

Lines changed: 35 additions & 0 deletions

File tree

‎.github/workflows/osps_security_assessment.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: OSPS Security Assessment
2+
3+
on:
4+
schedule:
5+
- cron: "0 9 * * 1" # Weekly on Mondays at 9 AM UTC
6+
workflow_dispatch: # Allow manual triggering
7+
8+
jobs:
9+
osps-assessment:
10+
runs-on: ubuntu-24.04
11+
12+
permissions:
13+
contents: read
14+
security-events: write # Required for SARIF upload
15+
16+
steps:
17+
- name: Checkout repository
18+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
19+
20+
- name: Open Source Project Security Baseline Scanner
21+
uses: revanite-io/osps-baseline-action@ffcef1f33b6ee5b916c7e357e4ae1481b99b46b6 # v1.0.0
22+
with:
23+
owner: ${{ github.repository_owner }}
24+
repo: ${{ github.event.repository.name }}
25+
token: ${{ secrets.GITHUB_TOKEN }}
26+
catalog: "osps-baseline"
27+
upload-sarif: "true"
28+
29+
- name: Upload Assessment Results
30+
if: always()
31+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
32+
with:
33+
name: osps-assessment-results-${{ github.run_number }}
34+
path: evaluation_results/
35+
retention-days: 30

0 commit comments

Comments
 (0)