actions-marketplace-validations/OSSF Scorecard action
Run OSSF Scorecard checks and output results in SARIF format
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Mar 19, 2026
- License
- Apache 2.0
Pinned Snippet
uses: actions-marketplace-validations/ossf_scorecard-action@05bb7c663f6ec9bd8484da0a5b5a77d423e3f88c # no releases — HEAD as of 2026-07-10tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| results_file | OUTPUT: Path to file to store results | yes | — |
| results_format | OUTPUT: format of the results [json, sarif] | yes | — |
| repo_token | INPUT: GitHub token with read access | no | ${{ github.token }} |
| publish_results | INPUT: Publish results | no | false |
| file_mode | INPUT: Method to fetch files from GitHub | no | archive |
| internal_publish_base_url | INPUT: Base URL for publishing results. Used for testing. | no | https://api.scorecard.dev |
| internal_default_token | INPUT: Default GitHub token. (Internal purpose only, not intended for developers to set. Used for pull requests configured with a PAT). | no | ${{ github.token }} |
Outputs
no outputs