name: OpenSSF Scorecard

on:
  schedule:
    - cron: '0 3 * * 0'  # Sundays at 3 AM UTC
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  scorecard:
    name: Scorecard Analysis
    runs-on: ubuntu-latest
    permissions:
      security-events: write  # Required for SARIF upload to Security tab
      id-token: write
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
        with:
          persist-credentials: false

      - name: Run Scorecard
        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
        with:
          results_file: results.sarif
          results_format: sarif
          publish_results: true

      - name: Upload SARIF results
        uses: github/codeql-action/upload-sarif@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0
        with:
          sarif_file: results.sarif
          category: openssf-scorecard
        continue-on-error: true

      - name: Upload artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v4.4.3
        with:
          name: scorecard-results
          path: results.sarif
          retention-days: 90
