Fix Scorecard CLI output and permissions

Author: krotname

.github/workflows/scorecard.yml

@@ -22,7 +22,7 @@ jobs:
       contents: read
       issues: read
       pull-requests: read
-      security-events: write
+      statuses: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
@@ -42,16 +42,17 @@ jobs:
       - name: Analyze
         env:
           GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ENABLE_SARIF: "true"
         run: |
           set -euo pipefail
           "$RUNNER_TEMP/scorecard/scorecard" \
             --repo="github.com/${{ github.repository }}" \
             --commit="${GITHUB_SHA}" \
-            --format=sarif \
-            --output="results.sarif" \
+            --format=json \
+            --output="scorecard-results.json" \
             --show-details
-      - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      - name: Upload Scorecard artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          sarif_file: results.sarif
+          name: openssf-scorecard
+          path: scorecard-results.json
+          if-no-files-found: error