fix(catalog): sync drifted action pins and remove a dead input (#43) #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OSSF Scorecard — push-to-default + weekly schedule only. The Scorecard action | |
| # supports only push and schedule on the default branch. | |
| name: scorecard | |
| on: | |
| push: | |
| branches: [main] | |
| schedule: | |
| - cron: "31 2 * * 1" | |
| permissions: {} | |
| jobs: | |
| scorecard: | |
| permissions: | |
| id-token: write # OIDC token for Scorecard provenance checks | |
| contents: read | |
| actions: read # inspect workflow definitions for the scoring checks | |
| uses: ./.github/workflows/public-scorecard-json.yml |