Add OpenSSF Scorecards GitHub Action#11348
Conversation
|
Why not running on prs? |
Scorecards does not fully work on "pull_request" triggers yet. They are working on supporting it. If you allow me, I'd say we wait for the official support. |
|
Thanks! |
Signed-off-by: Gabriela Gutierrez <[email protected]>
Signed-off-by: Gabriela Gutierrez <[email protected]>
Signed-off-by: Gabriela Gutierrez <[email protected]>
Signed-off-by: Gabriela Gutierrez <[email protected]>
Signed-off-by: Julien Pivotto <[email protected]>
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
|
Thanks! |
3 participants
Closes #11325
As described in the issue, this PR adds the OpenSSF Scorecards GitHub Action, which automatically checks the repo's supply-chain security processes and reports results to the repo's Security dashboard.
I have included some optional settings, but let me know if you would like them removed :)
scorecards.ymlfile. (optional)