ossf/OSSF Scorecard action
Run OSSF Scorecard checks and output results in SARIF format
View on GitHubTrust Signals
- Scorecard Score
- Scorecard 8–10scored Jul 25, 2025
- Maintenance Recency
- Activelast commit Jun 12, 2026
- License
- Apache 2.0
Pinned Snippet
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| results_file | OUTPUT: Path to file to store results | yes | — |
| results_format | OUTPUT: format of the results [json, sarif] | yes | — |
| repo_token | INPUT: GitHub token with read access | no | ${{ github.token }} |
| publish_results | INPUT: Publish results | no | false |
| file_mode | INPUT: Method to fetch files from GitHub | no | archive |
| internal_publish_base_url | INPUT: Base URL for publishing results. Used for testing. | no | https://api.scorecard.dev |
| internal_default_token | INPUT: Default GitHub token. (Internal purpose only, not intended for developers to set. Used for pull requests configured with a PAT). | no | ${{ github.token }} |
Outputs
no outputs