.odpi#6803 fix scorecards yaml

Signed-off-by: Nigel Jones <[email protected]>

.github/workflows/scorecards.yml

@@ -1,67 +1,67 @@
- # SPDX-License-Identifier: Apache-2.0
- # Copyright Contributors to the ODPi Egeria project.
- ---
- name: Scorecards supply-chain security
- on:
-   # Only the default branch is supported.
-   branch_protection_rule:
-   schedule:
-     - cron: '26 9 * * 6'
-   push:
-     branches: [ "master" ]
-   # Also allow for manual invocation for testing
-   workflow_dispatch:
+# SPDX-License-Identifier: Apache-2.0
+# Copyright Contributors to the ODPi Egeria project.
+---
+name: Scorecards supply-chain security
+on:
+  # Only the default branch is supported.
+  branch_protection_rule:
+  schedule:
+    - cron: '26 9 * * 6'
+  push:
+    branches: [ "master" ]
+  # Also allow for manual invocation for testing
+  workflow_dispatch:
 
- # Declare default permissions as read only.
- permissions: read-all
+# Declare default permissions as read only.
+permissions: read-all
 
- jobs:
-   analysis:
-     name: Scorecards analysis
-     runs-on: ubuntu-latest
-     permissions:
-       # Needed to upload the results to code-scanning dashboard.
-       security-events: write
-       # Used to receive a badge.
-       id-token: write
-       # Needs for private repositories.
-       contents: read
-       actions: read
+jobs:
+  analysis:
+    name: Scorecards analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Used to receive a badge.
+      id-token: write
+      # Needs for private repositories.
+      contents: read
+      actions: read
 
-     steps:
-       - name: "Checkout code"
-         uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0
-         with:
-           persist-credentials: false
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0
+        with:
+          persist-credentials: false
 
-       - name: "Run analysis"
-         uses: ossf/scorecard-action@865b4092859256271290c77adbd10a43f4779972 # tag=v2.0.3
-         with:
-           results_file: results.sarif
-           results_format: sarif
-           # (Optional) Read-only PAT token. Uncomment the `repo_token` line below if:
-           # - you want to enable the Branch-Protection check on a *public* repository, or
-           # - you are installing Scorecards on a *private* repository
-           # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
-           # repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@865b4092859256271290c77adbd10a43f4779972 # tag=v2.0.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) Read-only PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecards on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          # repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}
 
-           # Publish the results for public repositories to enable scorecard badges. For more details, see
-           # https://github.com/ossf/scorecard-action#publishing-results.
-           # For private repositories, `publish_results` will automatically be set to `false`, regardless
-           # of the value entered here.
-           publish_results: true
+          # Publish the results for public repositories to enable scorecard badges. For more details, see
+          # https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories, `publish_results` will automatically be set to `false`, regardless
+          # of the value entered here.
+          publish_results: true
 
-       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
-       # format to the repository Actions tab.
-       - name: "Upload artifact"
-         uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # tag=v3.0.0
-         with:
-           name: SARIF file
-           path: results.sarif
-           retention-days: 5
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # tag=v3.0.0
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
 
-       # Upload the results to GitHub's code scanning dashboard.
-       - name: "Upload to code-scanning"
-         uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26
-         with:
-           sarif_file: results.sarif
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26
+        with:
+          sarif_file: results.sarif