OSPS.yml

name: OSPS Security Assessment

on:
  schedule:
    - cron: "0 9 * * 1" # Weekly on Mondays at 9 AM UTC
  workflow_dispatch: # Allow manual triggering

# Default: least privilege. This job adds only the write scopes its steps need.
permissions:
  contents: read

jobs:
  osps-assessment:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      # code-scanning / Advanced Security SARIF upload (osps-baseline-action upload-sarif)
      security-events: write
      # actions/upload-artifact
      actions: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0

      - name: Open Source Project Security Baseline Scanner
        uses: revanite-io/osps-baseline-action@3bf988fa8e4b59568dcfac138a1854df87c15aff # v1.3.2
        with:
          owner: ${{ github.repository_owner }}
          repo: ${{ github.event.repository.name }}
          token: ${{ secrets.PVTR_GITHUB_TOKEN }}
          catalog: "osps-baseline"
          upload-sarif: "true"

      - name: Upload Assessment Results
        if: always()
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: osps-assessment-results-${{ github.run_number }}
          path: evaluation_results/
          retention-days: 30