🎨 Palette: 향상된 프리셋 버튼 접근성 (Target Size Presets) #5

	# Uploads an OpenSSF Scorecard code scanning analysis on every PR so the org
	# ruleset "CWL Central required workflows" -> code_scanning(Scorecard)
	# requirement can be satisfied on PR refs. scorecard-analysis.yml only runs on
	# push/schedule (default branch), so PRs never had a Scorecard analysis and
	# stayed mergeStateStatus=BLOCKED.
	#
	# NOTE: Scorecard reports repository-posture findings (branch protection, token
	# permissions, dependency pinning, ...) that are unrelated to the PR diff. The
	# org code_scanning ruleset rule therefore gates Scorecard at a raised
	# threshold (see the ruleset) so routine posture findings do not re-block every
	# merge; genuine high/critical findings still block.
	name: Scorecard PR

	on:
	pull_request:
	branches: [main]

	permissions:
	contents: read

	jobs:
	analysis:
	name: Scorecard
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	contents: read
	actions: read
	steps:
	- name: Checkout code
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false

	- name: Run analysis
	uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
	with:
	results_file: results.sarif
	results_format: sarif
	# publish_results is only valid on the default branch; PR runs upload
	# SARIF to code scanning without publishing to the public OpenSSF API.
	publish_results: false

	- name: Upload to code scanning
	uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
	with:
	sarif_file: results.sarif
	category: scorecard-pr

Navigation Menu