Scorecard supply-chain security scan #201

	# REFs:
	# * https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-openssf-scorecards-to-secure-workflows
	# * https://github.com/actions/starter-workflows/blob/666350e29b10d665a82d5c6d1501a29e50d63c29/code-scanning/scorecard.yml

	name: Scorecard supply-chain security scan
	on:
	schedule:
	- cron: '0 0 * * *' # run a scan everyday at 00:00 UTC
	push:
	branches: [ main ]

	permissions: read-all

	jobs:
	analysis:
	name: Scorecard analysis
	runs-on: ubuntu-latest
	permissions:
	# Needed to upload the results to code-scanning dashboard.
	security-events: write
	# Needed to publish results and get a badge (see publish_results below).
	id-token: write

	steps:
	- name: "Checkout code"
	uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
	with:
	persist-credentials: false

	- name: "Run analysis"
	uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
	with:
	results_file: results.sarif
	results_format: sarif
	publish_results: true

	- name: "Upload artifact"
	uses: actions/upload-artifact@c24449f33cd45d4826c6702db7e49f7cdb9b551d # v3.2.1-node20
	with:
	name: SARIF file
	path: results.sarif
	retention-days: 5

	- name: "Upload to code-scanning"
	uses: github/codeql-action/upload-sarif@294a9d92911152fe08befb9ec03e240add280cb3 # v3.26.8-64431c66d
	with:
	sarif_file: results.sarif

Provide feedback