8000 minor #60313 update scorecards actions (xabbuh) · symfony/symfony@e19fc0b · GitHub
[go: up one dir, main page]
Skip to content

Commit e19fc0b

Browse files
fabpotfabpot
committed
minor #60313 update scorecards actions (xabbuh)
This PR was merged into the 7.3 branch. Discussion ---------- update scorecards actions | Q | A | ------------- | --- | Branch? | 7.3 | Bug fix? | no | New feature? | no | Deprecations? | no | Issues | | License | MIT Commits ------- 119795e update scorecards actions
2 parents 8c8b58d + 119795e commit e19fc0b

File tree

1 file changed

+21
-14
lines changed

1 file changed

+21
-14
lines changed

‎.github/workflows/scorecards.yml

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -26,38 +26,45 @@ jobs:
2626

2727
steps:
2828
- name: "Checkout code"
29-
uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # v3.0.0
29+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3030
with:
3131
persist-credentials: false
3232

3333
- name: "Run analysis"
34-
uses: ossf/scorecard-action@3e15ea8318eee9b333819ec77a36aca8d39df13e # v1.1.1
34+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
3535
with:
3636
results_file: results.sarif
3737
results_format: sarif
38-
# (Optional) Read-only PAT token. Uncomment the `repo_token` line below if:
38+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
3939
# - you want to enable the Branch-Protection check on a *public* repository, or
40-
# - you are installing Scorecards on a *private* repository
41-
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
42-
# repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}
43-
44-
# Publish the results for public repositories to enable scorecard badges. For more details, see
45-
# https://github.com/ossf/scorecard-action#publishing-results.
46-
# For private repositories, `publish_results` will automatically be set to `false`, regardless
47-
# of the value entered here.
40+
# - you are installing Scorecard on a *private* repository
41+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
42+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
43+
44+
# Public repositories:
45+
# - Publish results to OpenSSF REST API for easy access by consumers
46+
# - Allows the repository to include the Scorecard badge.
47+
# - See https://github.com/ossf/scorecard-action#publishing-results.
48+
# For private repositories:
49+
# - `publish_results` will always be set to `false`, regardless
50+
# of the value entered here.
4851
publish_results: true
4952

53+
# (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
54+
# file_mode: git
55+
5056
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
5157
# format to the repository Actions tab.
5258
- name: "Upload artifact"
53-
uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v3.0.0
59+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
5460
with:
5561
name: SARIF file
5662
path: results.sarif
5763
retention-days: 5
5864

59-
# Upload the results to GitHub's code scanning dashboard.
65+
# Upload the results to GitHub's code scanning dashboard (optional).
66+
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
6067
- name: "Upload to code-scanning"
61-
uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # v1.0.26
68+
uses: github/codeql-action/upload-sarif@v3
6269
with:
6370
sarif_file: results.sarif

0 commit comments

Comments
 (0)
0