nordisk/dwarves

pipelines/scorecard.runa.ron

// scorecard.runa.ron — the OpenSSF Scorecard of a checkout in LOCAL mode, nightly.
//
// `cargo ci-verbs scorecard` (dwarves' detached ci/verbs crate, through the `ci-verbs`
// alias of this checkout) runs `scorecard --local <the run's checkout> --format json`
// ($SCORECARD_BIN, the checkout from $DWARVES_CI_CHECKOUT, which the forge sets) and
// writes scorecard.json and summary.md into the run's output; the forge shows the
// summary on the CI status page. Local mode cannot run the checks that need a GitHub or
// GitLab API (Branch-Protection, Code-Review, Maintained and others); the summary names
// them. A low score is not a red run: only a Scorecard that could not run is.
//
// Then `cargo ci-verbs openssf-badge` fetches the checkout's OpenSSF Best Practices badge
// (bestpractices.dev, the project named by `--badge <repo>=<id>`), checks it is a small SVG
// with no script and no event attribute, and writes publish/badges/openssf-<repo>.svg; the
// forge publishes that at badges/openssf-<repo>.svg in nordisk/ci-status (BADGE-7).
//
// The project names this file once per repository (`repo = "gunnar"`,
// `file_in = "dwarves"`) with `env = { RUSTFLAGS = "" }`: this checkout's
// .cargo/config.toml asks for clang + mold, which the ci4 image does not carry.
Pipeline(
    name: "scorecard",
    triggers: [
        Cron("30 2 * * *"),
        Manual,
    ],
    stages: [
        Stage(
            name: "scorecard",
            steps: [
                Xtask(cmd: "scorecard", alias: "ci-verbs", repo: "dwarves"),
                // BADGE-7: a checked copy of the checkout's OpenSSF Best Practices badge,
                // which the forge publishes at badges/openssf-<repo>.svg in ci-status
                // (only when it changed). gunnar.rs draws it from its own origin.
                Xtask(
                    cmd: "openssf-badge",
                    alias: "ci-verbs",
                    repo: "dwarves",
                    args: ["--badge", "gunnar=16084", "--badge", "holger=16086", "--badge", "heimdall=16105"],
                ),
            ],
        ),
    ],
)