From ff6e58b7e92cf8fa59612fd57536da5069fd8473 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 4 Jul 2026 12:33:36 +0100 Subject: [PATCH] fix(ci): split scorecard job to satisfy OpenSSF publish-results job-shape rule MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The scorecard job has been failing on every push to main since at least 2026-07-01 with "scorecard job must only have steps with `uses`" — the OpenSSF scorecard-action's publish_results endpoint rejects any job that mixes non-`uses` steps in with the scorecard-action step. Move the min-score shell check into a separate downstream job that consumes the results via artifact upload/download instead of running in-job. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/scorecard-enforcer.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml index 212cb1b2..8c40f56c 100644 --- a/.github/workflows/scorecard-enforcer.yml +++ b/.github/workflows/scorecard-enforcer.yml @@ -30,6 +30,20 @@ jobs: results_format: json publish_results: true + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: scorecard-results + path: results.json + retention-days: 5 + + check-score: + needs: scorecard + runs-on: ubuntu-latest + steps: + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: scorecard-results + - name: Check minimum score run: | # Parse score from results.json