Run Scorecard without root container

Author: krotname

.github/workflows/scorecard.yml

@@ -9,23 +9,48 @@ on:
     - cron: "23 3 * * 1"
   workflow_dispatch:
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   scorecard:
+    name: OSSF Scorecards
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
+      actions: read
+      checks: read
       contents: read
+      issues: read
+      pull-requests: read
       security-events: write
-      id-token: write
     steps:
-      - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
+          persist-credentials: false
+      - name: Install Scorecard CLI
+        env:
+          SCORECARD_VERSION: "5.5.0"
+          SCORECARD_SHA256: "83b90a05c1540ef1390db1cd5711e5fd04be9c1d8537fb84d39d02092d6a8dff"
+        run: |
+          set -euo pipefail
+          archive="scorecard_${SCORECARD_VERSION}_linux_amd64.tar.gz"
+          curl -fsSLO "https://github.com/ossf/scorecard/releases/download/v${SCORECARD_VERSION}/${archive}"
+          echo "${SCORECARD_SHA256}  ${archive}" | sha256sum -c -
+          mkdir -p "$RUNNER_TEMP/scorecard"
+          tar -xzf "${archive}" -C "$RUNNER_TEMP/scorecard" scorecard
+          chmod 0755 "$RUNNER_TEMP/scorecard/scorecard"
+      - name: Analyze
+        env:
+          GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ENABLE_SARIF: "true"
+        run: |
+          set -euo pipefail
+          "$RUNNER_TEMP/scorecard/scorecard" \
+            --repo="github.com/${{ github.repository }}" \
+            --commit="${GITHUB_SHA}" \
+            --format=sarif \
+            --output="results.sarif" \
+            --show-details
       - name: Upload SARIF
         uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with: