Run Scorecard without root container

Author: Andrei.Ovcharenko

.github/workflows/scorecard.yml

@@ -13,26 +13,50 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
-  scorecards:
+  scorecard:
     name: OSSF Scorecards
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
+      actions: read
+      checks: read
       contents: read
-      id-token: write
+      issues: read
+      pull-requests: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
+      - name: Install Scorecard CLI
+        env:
+          SCORECARD_VERSION: "5.5.0"
+          SCORECARD_SHA256: "83b90a05c1540ef1390db1cd5711e5fd04be9c1d8537fb84d39d02092d6a8dff"
+        run: |
+          set -euo pipefail
+          archive="scorecard_${SCORECARD_VERSION}_linux_amd64.tar.gz"
+          curl -fsSLO "https://github.com/ossf/scorecard/releases/download/v${SCORECARD_VERSION}/${archive}"
+          echo "${SCORECARD_SHA256}  ${archive}" | sha256sum -c -
+          mkdir -p "$RUNNER_TEMP/scorecard"
+          tar -xzf "${archive}" -C "$RUNNER_TEMP/scorecard" scorecard
+          chmod 0755 "$RUNNER_TEMP/scorecard/scorecard"
       - name: Analyze
-        continue-on-error: true
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        env:
+          GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ENABLE_SARIF: "true"
+        run: |
+          set -euo pipefail
+          "$RUNNER_TEMP/scorecard/scorecard" \
+            --repo="github.com/${{ github.repository }}" \
+            --commit="${GITHUB_SHA}" \
+            --format=sarif \
+            --output="scorecard-results.sarif" \
+            --show-details
+      - name: Upload Scorecard SARIF artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          results_file: scorecard-results.sarif
-          results_format: sarif
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_results: true
+          name: openssf-scorecard-sarif
+          path: scorecard-results.sarif
+          if-no-files-found: error