ossf-scorecard-reporting.yml

name: "OpenSSF Scoring"
on: 
  # Scheduled trigger
  schedule:
    # Run every Sunday at 00:00
    - cron: "0 0 * * 0"
  # Manual trigger
  workflow_dispatch:

# Permissions required to run this workflow (create issue and commit/push changes)
permissions:
  contents: write
  pull-requests: none 
  issues: write
  packages: none

jobs:
  security-scoring:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
      - name: OpenSSF Scorecard Monitor
        uses: UlisesGascon/openssf-scorecard-monitor@468db23fdfed383552532dbb3d3bbbf0a96dcd84 # v2.0.0-beta3
        with:
          scope: reports/ossf_scorecard/scope.json
          database: reports/ossf_scorecard/database.json
          report: reports/ossf_scorecard/report.md
          auto-commit: true
          auto-push: true
          generate-issue: true
          report-tags-enabled: true
          issue-title: "OpenSSF Scorecard Report Updated!"
          issue-assignees: 'fraxken'
          github-token: ${{ secrets.GITHUB_TOKEN }}
          max-request-in-parallel: 10
          discovery-enabled: true
          discovery-orgs: 'NodeSecure'