fix(ci): close the governance gate — SPDX, permissions, SHA pins, reu… #128

	# SPDX-License-Identifier: MPL-2.0
	name: Scorecards supply-chain security

	on:
	branch_protection_rule:
	schedule:
	- cron: '23 4 * * 1'
	push:
	branches: [main]

	# The reusable's scorecard job declares security-events:write + id-token:write;
	# a called workflow's job permissions must be a SUBSET of the caller's grant
	# (callee ⊆ caller) — `read-all` grants no writes, so the run startup-failed at
	# plan time with zero jobs.
	permissions:
	contents: read
	security-events: write
	id-token: write

	jobs:
	analysis:
	uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
	secrets: inherit

Provide feedback