name: OpenSSF Scorecard Review

on:

# For Branch-Protection check. Only the default branch is supported. See

# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection

branch_protection_rule:

# To guarantee that the Maintained check is occasionally updated. See

# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained

schedule:

- cron: '20 7 * * 2'

push:

branches:

- main

permissions: {}

jobs:

analysis:

name: Scorecard analysis

uses: nodejs/web-team/.github/workflows/scorecard.yml@b62c434f5e530041c288a40280567849449e74be

permissions:

# Needed to upload the results to code-scanning dashboard.

security-events: write

# Needed to publish results and get a badge (see publish_results below).

id-token: write

contents: read

actions: read