From b687040ed64d67527b8305357a64a4096dd2afcf Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 21 Jul 2026 21:59:14 +0100
Subject: [PATCH] fix(ci): use the canonical Scorecard wrapper instead of a
 local copy

The staleness gate rejects ANY workflow containing both
`ossf/scorecard-action@` and `github/codeql-action/upload-sarif@`, whatever
its triggers. 273 of 302 estate repos already call standards'
`scorecard-reusable.yml`, which reports with `results_format: json` +
`publish_results: true` and never uploads SARIF to Code Scanning.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/scorecard.yml | 37 ++++++++-------------------------
 1 file changed, 9 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 17b8ee8..64ac2ac 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -1,39 +1,20 @@
 # SPDX-License-Identifier: MPL-2.0
-# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-# SPDX-License-Identifier: MPL-2.0
 name: Scorecards supply-chain security
 
 on:
   branch_protection_rule:
   schedule:
-    - cron: '0 4 * * *'
-  workflow_dispatch:
-# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
-# updates do not pile up queued runs against the shared account-wide
-# Actions concurrency pool. Applied only to read-only check workflows
-# (no publish/mutation), so cancelling a superseded run is always safe.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-permissions:
-  contents: read
+    - cron: '23 4 * * 1'
+  push:
+    branches: [main]
+
+permissions: read-all
+
 jobs:
   analysis:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
     permissions:
+      contents: read
       security-events: write
       id-token: write
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1
-        with:
-          results_file: results.sarif
-          results_format: sarif
-      - name: Upload results
-        uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3.31.8
-        with:
-          sarif_file: results.sarif
+    secrets: inherit