workflow: update scorecard.yml #8

	name: Scorecard supply-chain security

	on:
	branch_protection_rule:
	schedule:
	- cron: '29 23 * * 3'
	push:
	branches: [ "main", "master" ]
	pull_request:
	branches: [ "main", "master" ]

	permissions: read-all

	jobs:
	visibility-check:
	# Bu job, deponun public/private olduğunu belirler
	outputs:
	visibility: ${{ steps.drv.outputs.visibility }}
	runs-on: ubuntu-latest
	steps:
	- name: Determine repository visibility
	id: drv
	run: \|
	visibility=$(gh api /repos/$GITHUB_REPOSITORY --jq '.visibility')
	echo "visibility=$visibility" >> $GITHUB_OUTPUT
	env:
	GH_TOKEN: ${{ github.token }}

	analysis:
	if: ${{ needs.visibility-check.outputs.visibility == 'public' }}
	needs: visibility-check
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	id-token: write
	steps:
	- name: "Checkout code"
	uses: actions/checkout@v4
	with:
	persist-credentials: false

	- name: "Run analysis"
	uses: ossf/[email protected]
	with:
	results_file: results.sarif
	results_format: sarif
	publish_results: true
	log_level: debug # Daha detaylı log al

	- name: "Check Scorecard output"
	run: cat results.sarif \|\| echo "SARIF output not generated"

	- name: "Debug: Check if results.sarif exists"
	run: ls -lah results.sarif \|\| echo "results.sarif NOT FOUND"

	- name: "Upload artifact"
	uses: actions/upload-artifact@v4
	with:
	name: es-query-builder-sarif

	path: results.sarif
	retention-days: 5

	- name: "Upload to code-scanning"
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: results.sarif

Provide feedback