From bdeb96c2090b302d6cfecdd701485195c9dc49ba Mon Sep 17 00:00:00 2001 From: cdeust Date: Sat, 25 Jul 2026 21:48:40 +0200 Subject: [PATCH] =?UTF-8?q?fix(scorecard):=20in-repo=20canonical=20workflo?= =?UTF-8?q?w=20=E2=80=94=20cross-repo=20reusable=20call=20cannot=20start?= =?UTF-8?q?=20or=20publish?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit startup_failure on main (0 jobs) after the green PR merged: this workflow class only triggers on main/schedule, so PR CI structurally cannot validate it. OSSF publish_results additionally requires the analyzed repo's own workflow as OIDC subject. Same pinned SHAs as the AP definition; workflow_dispatch retained for post-merge verification. Co-Authored-By: Claude Fable 5 --- .github/workflows/scorecard.yml | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 071cf914..32861eea 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -21,13 +21,41 @@ on: branches: [main] workflow_dispatch: +# REVERSAL NOTE (post-merge fix, issue #178): the call-site pattern +# (uses: cdeust/automatised-pipeline/.../scorecard.yml@main) produced +# startup_failure on main — zero jobs spawned — and scorecard-action's +# publish_results requires the OIDC subject to be THIS repo's own +# default-branch workflow, so a cross-repo reusable call cannot publish +# even when it starts. In-repo canonical template instead; the pinned +# SHAs below match the AP definition and drift is caught by Scorecard +# itself flagging unpinned/stale actions. This workflow only runs on +# main/schedule, so PR CI could not have caught the failure: verified +# post-merge via workflow_dispatch. permissions: read-all jobs: - scorecard: - uses: cdeust/automatised-pipeline/.github/workflows/scorecard.yml@main + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest permissions: security-events: write # upload SARIF to code scanning id-token: write # publish signed results to the OpenSSF API contents: read actions: read + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + + - name: Run analysis + uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1 + with: + results_file: results.sarif + results_format: sarif + publish_results: true + + - name: Upload SARIF to code scanning + uses: github/codeql-action/upload-sarif@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 + with: + sarif_file: results.sarif