From 289feb86016e5f8766d2b43ea1402adec2cc5901 Mon Sep 17 00:00:00 2001 From: "Francesa Alfaro, Agustin" Date: Tue, 17 Jun 2025 13:34:52 -0600 Subject: [PATCH] ci: adding ossf workflow and osff/codeql badges Signed-off-by: Francesa Alfaro, Agustin --- .github/workflows/scorecard-analysis.yml | 56 ++++++++++++++++++++++++ README.md | 8 +++- 2 files changed, 63 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/scorecard-analysis.yml diff --git a/.github/workflows/scorecard-analysis.yml b/.github/workflows/scorecard-analysis.yml new file mode 100644 index 0000000..3203a4d --- /dev/null +++ b/.github/workflows/scorecard-analysis.yml @@ -0,0 +1,56 @@ +name: Scorecard analysis workflow +on: + push: + # Only the default branch is supported. + branches: + - main + schedule: + # Weekly on Saturdays. + - cron: '30 1 * * 6' + +permissions: read-all + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + permissions: + # Needed for Code scanning upload + security-events: write + # Needed for GitHub OIDC token if publish_results is true + id-token: write + + steps: + - name: 'Checkout code' + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false + + - name: 'Run analysis' + uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2 + with: + results_file: results.sarif + results_format: sarif + # Scorecard team runs a weekly scan of public GitHub repos, + # see https://github.com/ossf/scorecard#public-data. + # Setting `publish_results: true` helps us scale by leveraging your workflow to + # extract the results instead of relying on our own infrastructure to run scans. + # And it's free for you! + publish_results: true + + # Upload the results as artifacts (optional). Commenting out will disable + # uploads of run results in SARIF format to the repository Actions tab. + # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts + - name: 'Upload artifact' + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard (optional). + # Commenting out will disable upload of results to your repo's Code Scanning dashboard + - name: 'Upload to code-scanning' + uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0 + with: + sarif_file: results.sarif diff --git a/README.md b/README.md index 8898eca..51ad6f6 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,10 @@ -# Sphinx theme based on Intel's Design System +[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/intel/intel-sphinx-theme/badge)](https://scorecard.dev/viewer/?uri=github.com/intel/intel-sphinx-theme) +[![CodeQL](https://github.com/intel/intel-sphinx-theme/workflows/CodeQL/badge.svg)](https://github.com/intel/intel-sphinx-theme/security/code-scanning) + + +# Intel® Sphinx Theme + +Sphinx theme based on Intel's Design System ## Installation and usage