docs(policy): retiring a flake means its references too (#566) #654
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| name: Scorecard | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| schedule: | |
| - cron: '0 0 * * 0' | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # Must cover everything scorecard-reusable's job requests (see codeql.yml). | |
| # id-token: write is the OIDC token Scorecard uses to publish results; | |
| # security-events: write uploads the SARIF. | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| id-token: write | |
| jobs: | |
| scorecard: | |
| uses: ./.github/workflows/scorecard-reusable.yml |