ci(scorecards): mirror ephapax#264 — startup_failure + webapp 400 (#178)

## Summary

Two estate-wide failures landed in
[hyperpolymath/ephapax#264](hyperpolymath/ephapax#264)
(merged 2026-06-01 11:59Z). boj-server carries the same two failures
with the same workflow shape. This PR mirrors the ephapax fix verbatim
so the two sibling repos stay in sync.

### \`scorecard.yml\` — caller alignment (startup_failure)

| Caller divergence | Was | Now |
|---|---|---|
| Concurrency | missing | \`group: \${{ github.workflow }}-\${{
github.ref }}\` |
| Trigger | \`branch_protection_rule:\` present (unused) | dropped;
\`workflow_dispatch:\` added |
| Secrets | \`secrets: inherit\` | dropped (reusable has no \`secrets:\`
block) |
| Permissions | \`permissions: read-all\` | \`permissions: contents:
read\` |

Pattern now matches the canonical caller example in
\`standards/.github/workflows/scorecard-reusable.yml\` verbatim. SHA pin
unchanged.

### \`scorecard-enforcer.yml\` — two-job split (webapp 400)

Score was being computed (typical ~5.5), but the OSSF Scorecard webapp
HTTP-400'd the signed-result POST because the publishing job contained a
\`run:\` step. Per
[ossf/scorecard-action#workflow-restrictions](https://github.com/ossf/scorecard-action#workflow-restrictions):

> scorecard job must only have steps with \`uses\`

Split into:
- **\`scorecard\`** (uses-only): runs scorecard-action with publish,
uploads SARIF, saves results.sarif as an artifact.
- **\`enforce-min-score\`** (\`needs: scorecard\`): downloads the
artifact, runs the bash min-score gate. \`run:\` steps are fine here —
it doesn't call scorecard-action.
- **\`check-critical\`** unchanged (already
uses-only-or-not-scorecard-publishing).

Action SHA pins verified via \`gh api\`
(\`actions/upload-artifact@4cec3d8\` +
\`actions/download-artifact@cc20338\`).

## Test plan

- [x] YAML parses (\`yaml.safe_load_all\` confirmed; scorecard.yml = 1
job \`analysis\`, scorecard-enforcer.yml = 3 jobs
\`scorecard\`/\`enforce-min-score\`/\`check-critical\`)
- [ ] CI on this PR shows \`Scorecards supply-chain security\` no longer
in \`startup_failure\`
- [ ] CI on this PR shows \`OpenSSF Scorecard Enforcer\` runs the
publish step without HTTP 400
- [ ] Post-merge, the next main run of both workflows goes green (or at
minimum exits the \`startup_failure\` / \`failure\` regression states
they've been in since the workflows were added)

Refs hyperpolymath/ephapax#264

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/scorecard-enforcer.yml

@@ -1,5 +1,30 @@
 # SPDX-License-Identifier: MPL-2.0
-# Prevention workflow - runs OpenSSF Scorecard and fails on low scores
+# Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# Prevention workflow - runs OpenSSF Scorecard and fails on low scores.
+#
+# Split into TWO jobs to satisfy the OSSF Scorecard webapp's workflow
+# restriction:
+#     "scorecard job must only have steps with `uses`"
+# (https://github.com/ossf/scorecard-action#workflow-restrictions).
+#
+# When the publishing job contains a `run:` step, the webapp rejects
+# the signed-result POST with HTTP 400 "workflow verification failed".
+# That regression had this workflow `failure`-state ever since
+# `publish_results: true` was added — the score *was* computed, but
+# the webapp publish step failed and propagated to job-level failure.
+#
+# Job 1 (`scorecard`): uses-only steps. Computes the score, publishes
+# signed results to the OSSF webapp, uploads SARIF to GitHub code
+# scanning, and saves results.sarif as an artifact for Job 2.
+#
+# Job 2 (`enforce-min-score`): downloads the artifact and runs the
+# minimum-score gate. May contain `run:` steps freely — it does not
+# call scorecard-action.
+#
+# Sister fix landed in hyperpolymath/ephapax#264 (2026-06-01); this
+# PR mirrors it so the two repos stay in sync.
+
 name: OpenSSF Scorecard Enforcer
 
 on:
@@ -43,14 +68,30 @@ jobs:
         with:
           sarif_file: results.sarif
 
+      - name: Upload results artifact for min-score gate
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: scorecard-results
+          path: results.sarif
+          retention-days: 7
+
+  enforce-min-score:
+    needs: scorecard
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download results artifact
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
+        with:
+          name: scorecard-results
+
       - name: Check minimum score
         run: |
-          # Parse score from results
+          # Parse score from SARIF results.
           SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0")
 
           echo "OpenSSF Scorecard Score: $SCORE"
 
-          # Minimum acceptable score (0-10 scale)
+          # Minimum acceptable score (0-10 scale).
           MIN_SCORE=5
 
           if [ "$(echo "$SCORE < $MIN_SCORE" | bc -l)" = "1" ]; then

.github/workflows/scorecard.yml

@@ -1,19 +1,36 @@
 # SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# Aligned with the documented caller pattern in
+# hyperpolymath/standards .github/workflows/scorecard-reusable.yml.
+# Previously this workflow was startup_failure-on-every-run because it
+# diverged from the reusable's documented caller shape:
+#   - missing `concurrency:` group (re-pushes piled up superseded runs)
+#   - `branch_protection_rule:` trigger (unused; complicates startup)
+#   - `secrets: inherit` against a reusable with no `secrets:` block
+#   - `permissions: read-all` instead of explicit `contents: read`
+# Pattern now matches the reusable's header example verbatim. Sister
+# fix landed in hyperpolymath/ephapax#264 (2026-06-01); this PR mirrors
+# it so the two repos stay in sync.
 name: Scorecards supply-chain security
 
 on:
-  branch_protection_rule:
-  schedule:
-    - cron: '23 4 * * 1'
   push:
     branches: [main]
+  schedule:
+    - cron: '23 4 * * 1'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis:
     permissions:
       security-events: write
       id-token: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef
-    secrets: inherit