require-scorecard-results-format-sarif
Rule catalog ID: R103
Targeted pattern scopeโ
Workflow steps that use ossf/scorecard-action.
What this rule reportsโ
This rule reports Scorecard action steps that do not set results_format: sarif.
Why this rule existsโ
If a repository wants Scorecard findings to flow into GitHub code scanning, SARIF is the correct results format. Requiring it makes the upload contract explicit.
โ Incorrectโ
- uses: ossf/scorecard-action@v2
โ Correctโ
- uses: ossf/scorecard-action@v2
with:
results_format: sarif
Additional examplesโ
This rule pairs naturally with require-scorecard-upload-sarif-step, which ensures the generated SARIF is actually published.
ESLint flat config exampleโ
import githubActions from "eslint-plugin-github-actions-2";
export default [githubActions.configs.codeScanning];
When not to use itโ
Disable this rule if your Scorecard workflow intentionally produces non-SARIF output for another destination.