fix(ci): reconcile scorecard.yml with governance staleness (stop SARIF→Code Scanning)

.github/workflows/scorecard.yml

@@ -1,8 +1,14 @@
 # SPDX-License-Identifier: MPL-2.0
+# Delegates to the canonical standards Scorecard reusable, which runs Scorecard
+# in JSON mode + `publish_results` and uploads the result as an artifact — it
+# does NOT push a SARIF file into GitHub Code Scanning. That reconciles this
+# workflow with the governance staleness gate ("Scorecard must not upload SARIF
+# to Code Scanning unless it runs for every PR head commit") while keeping the
+# canonical behaviour #159 intended.
 name: OSSF Scorecard
 on:
   push:
-    branches: [main, master]
+    branches: [main]
   schedule:
     - cron: '0 4 * * *'
   workflow_dispatch:
@@ -11,23 +17,8 @@ permissions: read-all
 
 jobs:
   analysis:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7c9db0e5909aab77bf11a444ade3b95c1d2b702e
     permissions:
+      contents: read
       security-events: write
       id-token: write
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          persist-credentials: false
-
-      - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1
-        with:
-          results_file: results.sarif
-          results_format: sarif
-
-      - name: Upload results
-        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.31.8
-        with:
-          sarif_file: results.sarif

.machine_readable/contractiles/k9/must-check.sh

@@ -27,7 +27,7 @@ for f in STATE.a2ml META.a2ml ECOSYSTEM.a2ml AGENTIC.a2ml NEUROSYM.a2ml PLAYBOOK
 done
 
 # --- All GitHub Actions SHA-pinned (no @vN / @branch) ---
-if grep -rnE "uses:[[:space:]]*[^#]*@v[0-9]" .github/workflows/*.yml 2>/dev/null | grep -vE "^\s*#" ; then
+if grep -rnE "uses:[[:space:]]*[^#]*@v[0-9]" .github/workflows/*.yml 2>/dev/null | grep -vE "^[[:space:]]*#" ; then
   err "unpinned GitHub Action(s) — pin to a full 40-char commit SHA"
 fi
 
@@ -63,4 +63,4 @@ done < <(find crates -name "*.rs" -not -path "*/target/*" 2>/dev/null)
 if [ "$fail" = "0" ]; then
   echo "must-check: all mechanically-verifiable MUST invariants satisfied."
 fi
-exit $fail
+exit "$fail"