1name: OSPS Baseline Scanner
 2
 3on:
 4  schedule:
 5    # Run weekly on Mondays at 9 AM UTC
 6    - cron: "0 9 * * 1"
 7  workflow_dispatch: # Allow manual triggering
 8
 9jobs:
10  osps-assessment:
11    runs-on: ubuntu-latest
12    name: Baseline Scan
13
14    permissions:
15      contents: read
16      security-events: write # Required for SARIF upload
17
18    steps:
19      - name: Checkout repository
20        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
21
22      - name: Generate GitHub App token
23        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
24        id: app-token
25        with:
26          client-id: ${{ secrets.GEMARA_AUTOMATION_CLIENT_ID }}
27          private-key: ${{ secrets.GEMARA_AUTOMATION_PRIVATE_KEY }}
28          owner: ${{ github.repository_owner }}
29          repositories: ${{ github.repository }}
30          permission-contents: read
31          permission-administration: read
32
33      - name: Run Baseline Action
34        uses: revanite-io/osps-baseline-action@b7d860b68755627c30ab692473511c90daee3ae8 # v1.3.4
35        with:
36          owner: ${{ github.repository_owner }}
37          repo: ${{ github.event.repository.name }}
38          token: ${{ steps.app-token.outputs.token }}
39          catalog: "osps-baseline-2026-02"
40          upload-sarif: "true"
41
42      - name: Upload Assessment Results
43        if: always()
44        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
45        with:
46          name: osps-assessment-results-${{ github.run_number }}
47          path: evaluation_results/
48          retention-days: 30