From 144ad5f263755919cefce9dbba9bc7c4a3a38077 Mon Sep 17 00:00:00 2001
From: fsl <1171313930@qq.com>
Date: Wed, 24 Jul 2024 19:24:14 +0800
Subject: [PATCH] ci: add Scorecard workflow (#3702)

---
 .github/workflows/sonarcloud.yaml | 53 +++++++++++++++++++++++++++++++
 sonar-project.properties          |  8 +++++
 2 files changed, 61 insertions(+)
 create mode 100644 .github/workflows/sonarcloud.yaml
 create mode 100644 sonar-project.properties

diff --git a/.github/workflows/sonarcloud.yaml b/.github/workflows/sonarcloud.yaml
new file mode 100644
index 000000000..38875b887
--- /dev/null
+++ b/.github/workflows/sonarcloud.yaml
@@ -0,0 +1,53 @@
+name: Sonarcloud Scan
+
+on:
+  schedule:
+    # Weekly on Saturdays.
+    - cron: '30 1 * * 6'
+  push:
+    branches: [ master ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecards analysis
+    runs-on: ubuntu-22.04
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Used to receive a badge. (Upcoming feature)
+      id-token: write
+      # Needs for private repositories.
+      contents: read
+      actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@v4
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@3ebbd71c74ef574dbc558c82f70e52732c8b44fe # v2.2.1
+        with:
+          sarif_file: results.sarif
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 000000000..b40cde24b
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,8 @@
+sonar.projectKey=gogf_gf
+sonar.organization=gogf
+
+sonar.sources=.
+
+sonar.sourceEncoding=UTF-8
+
+sonar.host.url=https://sonarcloud.io