From 2abec1cfb7555f1db83ff08de615cdbb7097d8ec Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 21:59:50 +0100 Subject: [PATCH] fix(ci): use the canonical Scorecard wrapper instead of a local copy The staleness gate rejects ANY workflow containing both `ossf/scorecard-action@` and `github/codeql-action/upload-sarif@`, whatever its triggers. 273 of 302 estate repos already call standards' `scorecard-reusable.yml`, which reports with `results_format: json` + `publish_results: true` and never uploads SARIF to Code Scanning. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/scorecard.yml | 33 +++++++++------------------------ 1 file changed, 9 insertions(+), 24 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index cba6ac6..64ac2ac 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,35 +1,20 @@ # SPDX-License-Identifier: MPL-2.0 -name: OSSF Scorecard +name: Scorecards supply-chain security on: - push: - branches: [main, master] + branch_protection_rule: schedule: - - cron: '0 4 * * *' - workflow_dispatch: + - cron: '23 4 * * 1' + push: + branches: [main] -permissions: - contents: read +permissions: read-all jobs: analysis: - runs-on: ubuntu-latest - timeout-minutes: 15 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 permissions: + contents: read security-events: write id-token: write - steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - persist-credentials: false - - - name: Run Scorecard - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1 - with: - results_file: results.sarif - results_format: sarif - - - name: Upload results - uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v3.31.8 - with: - sarif_file: results.sarif + secrets: inherit