noalimoy/OSSF Scorecard action
Run OSSF Scorecard checks and output results in SARIF format
View on GitHubTrust Signals
- Scorecard Score
- Scorecard 6–8scored Nov 18, 2025
- Maintenance Recency
- Maintainedlast commit Nov 18, 2025
- License
- Apache 2.0
Pinned Snippet
uses: noalimoy/scorecard-action-detached@81a6e2c3391a4141c0100b1de551d31870549ab7 # v0.1.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| results_file | OUTPUT: Path to file to store results | yes | — |
| results_format | OUTPUT: format of the results [json, sarif] | yes | — |
| repo_token | INPUT: GitHub token with read access | no | ${{ github.token }} |
| publish_results | INPUT: Publish results | no | false |
| file_mode | INPUT: Method to fetch files from GitHub | no | archive |
| source | INPUT: Source of the code to scan. Use 'local' to scan the local directory (respects working-directory), or 'remote' to scan a remote repository (uses GITHUB_REPOSITORY). If not set, defaults to automatic detection based on event type. | no | — |
| internal_publish_base_url | INPUT: Base URL for publishing results. Used for testing. | no | https://api.scorecard.dev |
| internal_default_token | INPUT: Default GitHub token. (Internal purpose only, not intended for developers to set. Used for pull requests configured with a PAT). | no | ${{ github.token }} |
Outputs
no outputs