README #36

	# OpenSSF Scorecard - supply-chain security analysis.
	# Publishes results to the OpenSSF dataset so the README badge renders.
	name: Scorecard

	on:
	push:
	branches: [ main ]
	schedule:
	- cron: '30 1 * * 1'
	workflow_dispatch:

	# Read-all so the checkout / analysis can inspect repo settings; the job below
	# grants only the extra write scopes it needs.
	permissions: read-all

	jobs:
	analysis:
	name: Scorecard analysis
	runs-on: ubuntu-latest
	permissions:
	# Needed to upload the SARIF results to the Security tab.
	security-events: write
	# Needed to publish results and get a badge (via publish_results: true).
	id-token: write

	steps:
	- name: Checkout repository
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Run analysis
	uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
	with:
	results_file: results.sarif
	results_format: sarif
	publish_results: true

	- name: Upload to code-scanning
	uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
	with:
	sarif_file: results.sarif

Provide feedback