For example, to verify the signature of `plugin-publish-plugin-2.0.0.jar` and its signature file `plugin-publish-plugin-2.0.0.jar.asc`, use this command:

```bash
gpg --verify plugin-publish-plugin-2.0.0.jar.asc plugin-publish-plugin-2.0.0.jar
```

jobs:
  analysis:
    name: Scorecard analysis
    runs-on: ubuntu-latest
    permissions:
      # Needed to upload the results to code-scanning dashboard.
      security-events: write
      # Needed to publish results and get a badge (see publish_results below).
      id-token: write
      # Uncomment the permissions below if installing in a private repository.
      # contents: read
      # actions: read

    steps:

      - name: Publish Test Report
        if: github.repository == 'square/okhttp' && github.ref == 'refs/heads/master'
        uses: mikepenz/action-junit-report@v6
        with:
          report_paths: '**/build/test-results/*/TEST-*.xml'
          check_name: OpenJDK 11 Test Report

      - name: Publish Test Results
        uses: EnricoMi/publish-unit-test-result-action@v2

          # The publish-snapshot workflow doesn't run tests, so we don't have to care which version Maven would select for that step.
          java-version: 25
          distribution: 'temurin'
          cache: 'maven'
          server-id: central
          server-username: CI_DEPLOY_USERNAME
          server-password: CI_DEPLOY_PASSWORD
      - name: 'Publish'
        env:

    name: Scorecards analysis
    runs-on: ubuntu-latest
    permissions:
      # Needed to upload the results to code-scanning dashboard.
      security-events: write
      # Needed to publish results and get a badge (see publish_results below).
      id-token: write

    steps:
      - name: "Checkout code"
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:

        api("com.gradle:develocity-gradle-plugin:4.3") // Run `java build-logic-settings/UpdateDevelocityPluginVersion.java <new-version>` to update
        api("com.gradle.publish:plugin-publish-plugin:1.3.1")
        api("gradle.plugin.org.jetbrains.gradle.plugin.idea-ext:gradle-idea-ext:1.3")
        api("me.champeau.gradle:japicmp-gradle-plugin:0.4.6")
        api("me.champeau.jmh:jmh-gradle-plugin:0.7.2")

                  <div class="well">
                      Sometimes, the change was made on the `release` branch but hasn't yet been published to the baseline version.
                      In that case, you can publish a new snapshot from the release branch. This will update `released-versions.json` on `master`.

    "name": "public-api-tests",
    "path": "testing/public-api-tests",
    "unitTests": false,
    "functionalTests": true,
    "crossVersionTests": false
  },
  {
    "name": "publish",
    "path": "platforms/software/publish",
    "unitTests": true,
    "functionalTests": true,
    "crossVersionTests": false
  },
  {
    "name": "report-rendering",

gradlePlugin-ksp = { module = "com.google.devtools.ksp:symbol-processing-gradle-plugin", version.ref = "ksp" }
gradlePlugin-mavenPublish = "com.vanniktech:gradle-maven-publish-plugin:0.35.0"
gradlePlugin-mavenSympathy = "io.github.usefulness.maven-sympathy:io.github.usefulness.maven-sympathy.gradle.plugin:0.3.0"
gradlePlugin-mrjar = "me.champeau.mrjar:me.champeau.mrjar.gradle.plugin:0.1.1"

        with:
          merge-multiple: true
          pattern: 'cache-${{ runner.os }}*'
          path: ${{ env.MIMIR_LOCAL }}
      - name: Publish cache
        uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
        if: ${{ github.event_name != 'pull_request' && !cancelled() && !failure() }}
        with: