ci(scorecards): mirror ephapax#264 — startup_failure + webapp 400

Two estate-wide failures that ephapax fixed today and boj-server still
carries. Mirror the same fix to keep the sibling repos in sync.

### `scorecard.yml` — caller alignment

Workflow was startup_failure-on-every-run because the caller diverged
from `hyperpolymath/standards`'s `scorecard-reusable.yml` documented
caller example in 4 ways:

  - missing `concurrency:` group (re-pushes piled up superseded runs)
  - `branch_protection_rule:` trigger present (unused; complicates startup)
  - `secrets: inherit` against a reusable with no `secrets:` block
  - `permissions: read-all` instead of explicit `contents: read`

Now matches the reusable's header example verbatim. SHA pin unchanged
(`e0caf11508a3989574713c78f5f444f2ce5e33ef`).

### `scorecard-enforcer.yml` — two-job split

Score itself was succeeding (~5.5 typical), but the OSSF Scorecard
webapp HTTP-400'd the signed-result POST whenever the `scorecard` job
contained a `run:` step (per
https://github.com/ossf/scorecard-action#workflow-restrictions —
"scorecard job must only have steps with `uses`"). The webapp's
workflow verifier rejects mixed-shape jobs when `publish_results: true`
triggers the signed-publish path.

Split into:
  - `scorecard` (uses-only): runs scorecard-action with publish,
    uploads SARIF, saves results.sarif as an artifact for Job 2.
  - `enforce-min-score` (needs: scorecard): downloads the artifact and
    runs the bash min-score gate. `run:` steps are fine here because
    this job does not call scorecard-action.

Action SHA pins verified via `gh api repos/<org>/<action>/commits/<sha>`
(`actions/upload-artifact@4cec3d8` + `actions/download-artifact@cc20338`).

Refs hyperpolymath/ephapax#264

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/scorecard-enforcer.yml

@@ -1,5 +1,30 @@
 # SPDX-License-Identifier: MPL-2.0
-# Prevention workflow - runs OpenSSF Scorecard and fails on low scores
+# Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# Prevention workflow - runs OpenSSF Scorecard and fails on low scores.
+#
+# Split into TWO jobs to satisfy the OSSF Scorecard webapp's workflow
+# restriction:
+#     "scorecard job must only have steps with `uses`"
+# (https://github.com/ossf/scorecard-action#workflow-restrictions).
+#
+# When the publishing job contains a `run:` step, the webapp rejects
+# the signed-result POST with HTTP 400 "workflow verification failed".
+# That regression had this workflow `failure`-state ever since
+# `publish_results: true` was added — the score *was* computed, but
+# the webapp publish step failed and propagated to job-level failure.
+#
+# Job 1 (`scorecard`): uses-only steps. Computes the score, publishes
+# signed results to the OSSF webapp, uploads SARIF to GitHub code
+# scanning, and saves results.sarif as an artifact for Job 2.
+#
+# Job 2 (`enforce-min-score`): downloads the artifact and runs the
+# minimum-score gate. May contain `run:` steps freely — it does not
+# call scorecard-action.
+#
+# Sister fix landed in hyperpolymath/ephapax#264 (2026-06-01); this
+# PR mirrors it so the two repos stay in sync.
+
 name: OpenSSF Scorecard Enforcer
 
 on:
@@ -43,14 +68,30 @@ jobs:
         with:
           sarif_file: results.sarif
 
+      - name: Upload results artifact for min-score gate
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: scorecard-results
+          path: results.sarif
+          retention-days: 7
+
+  enforce-min-score:
+    needs: scorecard
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download results artifact
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
+        with:
+          name: scorecard-results
+
       - name: Check minimum score
         run: |
-          # Parse score from results
+          # Parse score from SARIF results.
           SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0")
 
           echo "OpenSSF Scorecard Score: $SCORE"
 
-          # Minimum acceptable score (0-10 scale)
+          # Minimum acceptable score (0-10 scale).
           MIN_SCORE=5
 
           if [ "$(echo "$SCORE < $MIN_SCORE" | bc -l)" = "1" ]; then

.github/workflows/scorecard.yml

@@ -1,19 +1,36 @@
 # SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# Aligned with the documented caller pattern in
+# hyperpolymath/standards .github/workflows/scorecard-reusable.yml.
+# Previously this workflow was startup_failure-on-every-run because it
+# diverged from the reusable's documented caller shape:
+#   - missing `concurrency:` group (re-pushes piled up superseded runs)
+#   - `branch_protection_rule:` trigger (unused; complicates startup)
+#   - `secrets: inherit` against a reusable with no `secrets:` block
+#   - `permissions: read-all` instead of explicit `contents: read`
+# Pattern now matches the reusable's header example verbatim. Sister
+# fix landed in hyperpolymath/ephapax#264 (2026-06-01); this PR mirrors
+# it so the two repos stay in sync.
 name: Scorecards supply-chain security
 
 on:
-  branch_protection_rule:
-  schedule:
-    - cron: '23 4 * * 1'
   push:
     branches: [main]
+  schedule:
+    - cron: '23 4 * * 1'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis:
     permissions:
       security-events: write
       id-token: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef
-    secrets: inherit