scorecard.yml

# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
#
# Aligned with the documented caller pattern in
# hyperpolymath/standards .github/workflows/scorecard-reusable.yml.
# Previously this workflow was startup_failure-on-every-run because it
# diverged from the reusable's documented caller shape:
#   - missing `concurrency:` group (re-pushes piled up superseded runs)
#   - `branch_protection_rule:` trigger (unused; complicates startup)
#   - `secrets: inherit` against a reusable with no `secrets:` block
#   - `permissions: read-all` instead of explicit `contents: read`
# Pattern now matches the reusable's header example verbatim. Sister
# fix landed in hyperpolymath/ephapax#264 (2026-06-01); this PR mirrors
# it so the two repos stay in sync.
name: Scorecards supply-chain security

on:
  schedule:
    - cron: '23 4 * * 1'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  actions: read
  contents: read

jobs:
  analysis:
    permissions:
      # `contents: read` is REQUIRED, not redundant. Declaring `permissions:`
      # at job level sets every unlisted scope to `none`, and a called
      # workflow can never hold more than the calling job grants it. The
      # reusable declares top-level `permissions: contents: read` and its
      # first step is actions/checkout, so omitting `contents` here handed
      # it `contents: none` and the call died at startup with zero jobs.
      # The green sibling (boj-server-cartridges) lists all three.
      contents: read
      security-events: write
      id-token: write
    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9