Do Scorecard analysis #1

	# Summary: workflow for OSSF Scorecard (https://github.com/ossf/scorecard).
	#
	# Scorecard checks for security best practices. Its use is suggested in
	# Google's GitHub guidance.
	# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

	name: Scorecard analysis
	run-name: Do ${{inputs.reason}} Scorecard analysis

	on:
	merge_group:
	types:
	- checks_requested

	# Allow calling from nightly.yaml.
	workflow_call:
	inputs:
	# Why is this workflow being called?
	reason:
	type: string
	required: false

	# Allow manual invocation.
	workflow_dispatch:

	# Declare default permissions as read only.
	permissions: read-all

	jobs:
	scorecard:
	name: Run
	runs-on: ubuntu-22.04
	timeout-minutes: 15
	permissions:
	# Needed to upload the results to code-scanning dashboard.
	security-events: write
	# Needed to publish results and get a badge (see publish_results below).
	id-token: write
	steps:
	- name: Check out a copy of the git repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Run Scorecard analysis
	uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
	with:
	# Save the results
	results_file: results.sarif
	results_format: sarif

	# Publish results to OpenSSF REST API.
	# See https://github.com/ossf/scorecard-action#publishing-results.
	publish_results: true

	- name: Upload results to code-scanning dashboard
	uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3
	with:
	sarif_file: results.sarif

Provide feedback