Create scorecard.yml #2888
Create scorecard.yml #2888
Conversation
Suggested by Google's internal GitHub Security Recommendations.
cpovirk
left a comment
cpovirk
left a comment
There was a problem hiding this comment.
As you might already have surmised, this new file should be covered by your existing Dependabot setup for GitHub Actions, which matches Guava's setup, which has successfully led to PRs like https://github.com/google/guava/pull/7912/files.
Co-authored-by: Chris Povirk <[email protected]>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # Commenting out will disable upload of results to your repo's Code Scanning dashboard | ||
| - name: "Upload to code-scanning" | ||
| github/codeql-action/upload-sarif@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5 | ||
| with: |
Check notice
Code scanning / CodeQL
Syntax error Note
There was a problem hiding this comment.
Should be fixed by latest commit.
|
There is also an old PR (#2353) for adding |
That's funny! I have zero recollection of that, even though I apparently created it. |
Suggested by Google's internal GitHub Security Recommendations.