From 3012aba0bc3c261e690076aeba31d9d3c4cdd68c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 25 Aug 2026 23:20:38 +0100 Subject: [PATCH] fix(ci): restore the Scorecard SARIF upload deleted in June Commit 5a93d9d5 (PR #393, 'Ci/gitleaks self hosted fix', 2026-06-21) deleted the SARIF output and its upload step from scorecard-reusable.yml as collateral of an unrelated gitleaks refactor -- 93 lines removed from this file in a commit about something else. Since then Scorecard has emitted results_format: json only, which feeds the public OpenSSF API and the badge but NOT GitHub code scanning. So: * the badge kept updating, which is why nobody noticed * the Security tab has heard nothing for ~3 months MEASURED in this repo 2026-08-25: all 12 Scorecard alerts frozen at commit 3e57141d, updated_at 2026-06-03, while Hypatia alerts in the same repo updated 2026-08-24. scorecard.yml ran SUCCESSFULLY on 08-07 and 08-09 and produced nothing. The worse half is not the stale alerts. It is that a genuinely NEW regression in pinned-dependencies, token-permissions or SAST would raise no alert at all. publish_results is independent of results_format, so switching to SARIF keeps the badge. Both outputs are live with this shape. Also adds the codeql-action lockfile entry for this workflow; without it the workflow would die at 0s, which is a separate estate fault this change must not walk into. Estate-wide context: memory records 545 frozen Scorecard alerts gating 106 repos. This fixes the source for standards; the same deletion likely needs reverting wherever else the reusable was copied rather than called. Co-Authored-By: Claude Opus 5 --- .github/workflows/actions.lock | 1 + .github/workflows/scorecard-reusable.yml | 21 ++++++++++++++++++--- 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index fc6e0913..5778a7f0 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -92,6 +92,7 @@ workflows: - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' '.github/workflows/scorecard-reusable.yml': + - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' diff --git a/.github/workflows/scorecard-reusable.yml b/.github/workflows/scorecard-reusable.yml index 4e32fade..88f23737 100644 --- a/.github/workflows/scorecard-reusable.yml +++ b/.github/workflows/scorecard-reusable.yml @@ -29,13 +29,28 @@ jobs: - name: Run Scorecard Analysis uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: - results_file: results.json - results_format: json + results_file: results.sarif + results_format: sarif + # publish_results feeds the public OpenSSF API and the badge, and is + # INDEPENDENT of results_format -- so emitting SARIF does not cost us + # the badge. Both outputs are live with this shape. publish_results: true + # RESTORED 2026-08-25. Commit 5a93d9d5 (PR #393, "Ci/gitleaks self hosted + # fix", 2026-06-21) deleted this step and switched results_format to json + # as collateral of an unrelated gitleaks refactor. Without a SARIF upload + # nothing feeds GitHub code scanning, so every Scorecard alert in the + # estate froze: measured in this repo on 2026-08-25, all 12 Scorecard + # alerts were stuck at 2026-06-03 while Hypatia's updated 2026-08-24. + # The badge kept working, which is why it went unnoticed. + - name: Upload SARIF to code scanning + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v3 + with: + sarif_file: results.sarif + - name: Upload results artifact uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: scorecard-results - path: results.json + path: results.sarif retention-days: 90