Publish Scorecard SARIF results

Author: krotname

.github/workflows/scorecard.yml

@@ -22,6 +22,7 @@ jobs:
       contents: read
       issues: read
       pull-requests: read
+      security-events: write
       statuses: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -50,9 +51,26 @@ jobs:
             --format=json \
             --output="scorecard-results.json" \
             --show-details
+      - name: Analyze SARIF
+        env:
+          GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          "$RUNNER_TEMP/scorecard/scorecard" \
+            --repo="github.com/${{ github.repository }}" \
+            --commit="${GITHUB_SHA}" \
+            --format=sarif \
+            --output="scorecard-results.sarif" \
+            --show-details
+      - name: Upload Scorecard SARIF
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        with:
+          sarif_file: scorecard-results.sarif
       - name: Upload Scorecard artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: openssf-scorecard
-          path: scorecard-results.json
+          path: |
+            scorecard-results.json
+            scorecard-results.sarif
           if-no-files-found: error