- name: 'Cancel previous runs'
        uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1
        with:
          access_token: ${{ github.token }}
      - name: 'Check out repository'
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
      - name: 'Set up JDK ${{ matrix.java }}'
        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1

# policy, and support documentation.

name: Scorecard supply-chain security
on:
  # For Branch-Protection check. Only the default branch is supported. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
  branch_protection_rule:
  # To guarantee Maintained check is occasionally updated. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
  schedule:

    runs-on: ${{ matrix.platform }}

    steps:
    - name: Set up Go 1.x
      uses: actions/setup-go@v4
      with:
        go-version: ${{ matrix.go }}

    - name: Check out code into the Go module directory
      uses: actions/checkout@v4

    - name: go mod package cache
      uses: actions/cache@v4
      with:
        path: ~/go/pkg/mod