scorecard-enforcer.yml

# SPDX-License-Identifier: MPL-2.0
# Prevention workflow - runs OpenSSF Scorecard and fails on low scores
name: OpenSSF Scorecard Enforcer

on:
  push:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'  # Weekly on Monday
  workflow_dispatch:

# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
# updates do not pile up queued runs against the shared account-wide
# Actions concurrency pool. Applied only to read-only check workflows
# (no publish/mutation), so cancelling a superseded run is always safe.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  # The OSSF Scorecard publish endpoint enforces a hard contract: the job that
  # runs `ossf/scorecard-action` with `publish_results: true` must contain
  # ONLY steps with `uses:` (no `run:` steps in the same job). If a `run:`
  # step is present, the publish step fails with:
  #   "webapp: scorecard job must only have steps with uses"
  # (49 estate repos hit this; see ROADMAP audit 2026-05-30.)
  #
  # Fix: split the threshold check into a downstream job that depends on
  # `scorecard` and consumes the SARIF artifact. The `scorecard` job stays
  # uses-only; `check-score` is the gating job that emits the error.
  scorecard:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      id-token: write  # For OIDC
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Run Scorecard
        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
        with:
          results_file: results.sarif
          results_format: sarif
          publish_results: true

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4
        with:
          sarif_file: results.sarif

      - name: Persist SARIF for downstream score-gate job
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: scorecard-results
          path: results.sarif
          retention-days: 1

  check-score:
    needs: scorecard
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Download SARIF from scorecard job
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v5.0.0
        with:
          name: scorecard-results

      - name: Check minimum score
        run: |
          SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0")

          echo "OpenSSF Scorecard Score: $SCORE"

          # Minimum acceptable score (0-10 scale)
          MIN_SCORE=5

          if [ "$(echo "$SCORE < $MIN_SCORE" | bc -l)" = "1" ]; then
            echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE"
            exit 1
          fi

  # Check specific high-priority items
  check-critical:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check SECURITY.md exists
        run: |
          if [ ! -f "SECURITY.md" ]; then
            echo "::error::SECURITY.md is required"
            exit 1
          fi

      - name: Check for pinned dependencies
        run: |
          # Check workflows for unpinned actions
          unpinned=$(grep -r "uses:.*@v[0-9]" .github/workflows/*.yml 2>/dev/null | grep -v "#" | head -5 || true)
          if [ -n "$unpinned" ]; then
            echo "::warning::Found unpinned actions:"
            echo "$unpinned"
          fi