ci: scorecard 50/50 startup_failure + scorecard-enforcer webapp 400 + governance SHA-pin (#264)

## Summary

Three foundational CI bugs surfaced by direct audit; each fixed at the
correct layer (in-repo, not estate-wide).

### `scorecard-enforcer.yml` — two-job split

Score itself was succeeding (7.9 measured), but the OSSF Scorecard
webapp HTTP-400'd the signed-result POST:

> workflow verification failed: scorecard job must only have steps with
`uses`, see
https://github.com/ossf/scorecard-action#workflow-restrictions

because the `scorecard` job had a `Check minimum score` step that used
`run:`. The webapp's workflow verifier rejects mixed-shape jobs when
`publish_results: true` triggers the signed-publish path.

**Fix**: split the single job into two:
- `scorecard` (uses-only): runs scorecard-action with publish, uploads
SARIF, saves `results.sarif` as actions artifact.
- `enforce-min-score` (needs: scorecard): downloads the artifact and
runs the bash min-score gate. `run:` steps are fine here because this
job does NOT call scorecard-action.

Action SHA pins verified via `gh api repos/<org>/<action>/commits/<sha>`
(`actions/upload-artifact@4cec3d8` +
`actions/download-artifact@cc20338`).

### `scorecard.yml` — align with documented caller pattern

**50/50 ever runs** of this workflow are `startup_failure` (workflow has
never successfully run). Caller diverged from the reusable's documented
caller-example in 4 ways:

1. Missing `concurrency:` group — re-pushes piled up superseded runs.
2. `branch_protection_rule:` trigger present (unused; complicates
startup).
3. `secrets: inherit` against a reusable with no `secrets:` block.
4. `permissions: read-all` instead of explicit `contents: read`.

**Fix**: now matches the reusable's header example verbatim. SHA pin
unchanged.

### `governance.yml` — SHA-pin floating `@main` ref

Per memory hook `feedback_gh_run_rerun_caches_floating_ref_resolution`,
floating refs cache resolution unpredictably across re-runs. Pinned to
`d3f799c639420ac68ac7ed83d2166b625b4b73f0` (current
`hyperpolymath/standards` main); `governance-reusable.yml` verified
present at that SHA.

## Test plan

- [ ] Scorecard run after merge: confirm publish step no longer
HTTP-400s; signed result reaches OSSF webapp
- [ ] Scorecards run after merge: workflow actually starts (not
startup_failure) and produces a run
- [ ] Governance run after merge: no resolution flap

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance.yml

@@ -22,4 +22,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d3f799c639420ac68ac7ed83d2166b625b4b73f0

.github/workflows/scorecard-enforcer.yml

@@ -1,5 +1,25 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-# Prevention workflow - runs OpenSSF Scorecard and fails on low scores
+# Prevention workflow - runs OpenSSF Scorecard and fails on low scores.
+#
+# Split into TWO jobs to satisfy the OSSF Scorecard webapp's workflow
+# restriction:
+#     "scorecard job must only have steps with `uses`"
+# (https://github.com/ossf/scorecard-action#workflow-restrictions).
+#
+# When the publishing job contains a `run:` step, the webapp rejects
+# the signed-result POST with HTTP 400 "workflow verification failed".
+# That regression had this workflow `failure`-state ever since
+# `publish_results: true` was added — the score *was* computed, but
+# the webapp publish step failed and propagated to job-level failure.
+#
+# Job 1 (`scorecard`): uses-only steps. Computes the score, publishes
+# signed results to the OSSF webapp, uploads SARIF to GitHub code
+# scanning, and saves results.json as an artifact for Job 2.
+#
+# Job 2 (`enforce-min-score`): downloads the artifact and runs the
+# minimum-score gate. May contain `run:` steps freely — it does not
+# call scorecard-action.
+
 name: OpenSSF Scorecard Enforcer
 
 on:
@@ -43,14 +63,30 @@ jobs:
         with:
           sarif_file: results.sarif
 
+      - name: Upload results artifact for min-score gate
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: scorecard-results
+          path: results.sarif
+          retention-days: 7
+
+  enforce-min-score:
+    needs: scorecard
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download results artifact
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
+        with:
+          name: scorecard-results
+
       - name: Check minimum score
         run: |
-          # Parse score from results
+          # Parse score from SARIF results.
           SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0")
 
           echo "OpenSSF Scorecard Score: $SCORE"
 
-          # Minimum acceptable score (0-10 scale)
+          # Minimum acceptable score (0-10 scale).
           MIN_SCORE=5
 
           if [ "$(echo "$SCORE < $MIN_SCORE" | bc -l)" = "1" ]; then

.github/workflows/scorecard.yml

@@ -1,19 +1,32 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
+# Aligned with the documented caller pattern in
+# hyperpolymath/standards .github/workflows/scorecard-reusable.yml.
+# Previously this workflow was startup_failure-on-every-run (50/50)
+# because it diverged from the reusable's documented caller shape:
+#   - missing `concurrency:` group (re-pushes piled up superseded runs)
+#   - `branch_protection_rule:` trigger (unused; complicates startup)
+#   - `secrets: inherit` against a reusable with no `secrets:` block
+#   - `permissions: read-all` instead of explicit `contents: read`
+# Pattern now matches the reusable's header example verbatim.
 name: Scorecards supply-chain security
 
 on:
-  branch_protection_rule:
-  schedule:
-    - cron: '23 4 * * 1'
   push:
     branches: [main]
+  schedule:
+    - cron: '23 4 * * 1'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis:
     permissions:
       security-events: write
       id-token: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef
-    secrets: inherit