chore(deps-dev): update pytest requirement from >=8.0.0 to >=9.0.3 (#… #27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OpenSSF Scorecard - Security health metrics for Open Source | |
| # | |
| # Measures repository security posture across 18+ checks: | |
| # token permissions, branch protection, dependency update tools, | |
| # fuzzing, SAST, vulnerabilities, and more. | |
| # | |
| # Results are uploaded to the GitHub Security tab and OpenSSF Scorecard API. | |
| # View badge at: https://api.securityscorecards.dev/projects/github.com/kagenti/plugins-adapter | |
| # | |
| # NOTE: Scorecard only works on 'schedule' and 'push' triggers, NOT 'pull_request' | |
| # This is a GitHub/Scorecard limitation for result publishing. | |
| # See: https://github.com/ossf/scorecard-action#workflow-restrictions | |
| # | |
| # Token Requirements: | |
| # - id-token: write for OIDC verification when publishing results | |
| # - security-events: write to upload SARIF to Security tab | |
| # | |
| name: OpenSSF Scorecard | |
| on: | |
| # Run weekly on Monday at 6:30 AM UTC (offset from kagenti/kagenti to spread load) | |
| schedule: | |
| - cron: '30 6 * * 1' | |
| # Run on push to main to track regressions immediately | |
| push: | |
| branches: [main] | |
| # Allow manual trigger | |
| workflow_dispatch: | |
| # Deny all permissions at workflow level; each job declares only what it needs | |
| # Required by Scorecard: https://github.com/ossf/scorecard-action#workflow-restrictions | |
| permissions: {} | |
| jobs: | |
| scorecard: | |
| name: Scorecard Analysis | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| security-events: write # Upload SARIF to Security tab | |
| id-token: write # OIDC token for result verification and publishing | |
| contents: read # Read repository contents | |
| actions: read # Read workflow runs (needed for Token-Permissions check) | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Run OpenSSF Scorecard | |
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | |
| with: | |
| results_file: scorecard.sarif | |
| results_format: sarif | |
| # Publish results to OpenSSF API (enables public badge and tracking) | |
| publish_results: true | |
| - name: Upload SARIF to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 | |
| with: | |
| sarif_file: scorecard.sarif | |
| - name: Upload Scorecard results as artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: scorecard-results | |
| path: scorecard.sarif | |
| retention-days: 30 |