fabasoad/OpenSSF Scorecard Action
Workflow enhancements for OpenSSF Scorecard with notifications, thresholds, and reporting
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Nov 6, 2025
- License
- Apache 2.0
Pinned Snippet
uses: fabasoad/broadsage-scorecard-action@8f31811c25cdf583d271fcdebaa798850bde290f # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| repo_token | GitHub token for analysis (defaults to GITHUB_TOKEN) | no | ${{ github.token }} |
| results_file | Path to save scorecard results | no | scorecard-results.sarif |
| results_format | Output format (sarif, json) | no | sarif |
| publish_results | Publish results to OpenSSF API | no | true |
| minimum_score_threshold | Minimum acceptable score (0.0-10.0) for workflow decisions | no | 6.0 |
| fail_on_score | Fail action if score below threshold | no | false |
| slack_bot_token | Slack Bot Token for notifications | no | "" |
| slack_channel_id | Slack channel ID for notifications | no | "" |
| webhook_url | Generic webhook URL for notifications | no | "" |
| retention_days | Days to retain artifacts | no | 30 |
| artifact_name | Name for uploaded artifacts | no | scorecard-analysis-results |
Outputs
| name | description |
|---|---|
| overall_score | Overall OpenSSF Scorecard score (0.0-10.0) |
| passed_checks | Number of checks passed |
| total_checks | Total number of checks performed |
| failed_checks | Number of checks failed |
| threshold_met | Whether score meets minimum threshold |
| analysis_success | Whether analysis completed successfully |