Fix scorecard.yml wrappers to comply with estate policy (Issue #520)

Issue #520: scorecard.yml template violates the estate's own Scorecard/SARIF policy
which requires OSSF Scorecard to run on every PR head commit when uploading to
Code Scanning.

Fix: Add pull_request trigger, concurrency, actions: read permission, and
secrets: inherit to all scorecard.yml wrapper files across the estate.

Updated 20 files in:
- 0-ai-gatekeeper-protocol/ (3 files)
- a2ml/ (6 files)
- consent-aware-http/
- k9-svc/ (6 files)
- lol/
- rhodium-standard-repositories/ (4 files)

Part of estate-wide CI/CD deduplication.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

Author: hyperpolymath

0-ai-gatekeeper-protocol/.github/workflows/scorecard.yml

@@ -4,13 +4,21 @@ name: OSSF Scorecard
 on:
   push:
     branches: [main, master]
+  pull_request:
+    branches: [main, master]
   schedule:
     - cron: '0 4 * * *'
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
+  actions: read
   contents: read
 
 jobs:
   scorecard:
     uses: ../../.github/workflows/scorecard-reusable.yml
+    secrets: inherit

0-ai-gatekeeper-protocol/mcp-repo-guardian/.github/workflows/scorecard.yml

@@ -4,13 +4,21 @@ name: OSSF Scorecard
 on:
   push:
     branches: [main, master]
+  pull_request:
+    branches: [main, master]
   schedule:
     - cron: '0 4 * * *'
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
+  actions: read
   contents: read
 
 jobs:
   scorecard:
     uses: ../../../.github/workflows/scorecard-reusable.yml
+    secrets: inherit

0-ai-gatekeeper-protocol/repo-guardian-fs/.github/workflows/scorecard.yml

@@ -4,13 +4,21 @@ name: OSSF Scorecard
 on:
   push:
     branches: [main, master]
+  pull_request:
+    branches: [main, master]
   schedule:
     - cron: '0 4 * * *'
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
+  actions: read
   contents: read
 
 jobs:
   scorecard:
     uses: ../../../.github/workflows/scorecard-reusable.yml
+    secrets: inherit

a2ml/.github/workflows/scorecard.yml

@@ -4,13 +4,21 @@ name: OSSF Scorecard
 on:
   push:
     branches: [main, master]
+  pull_request:
+    branches: [main, master]
   schedule:
     - cron: '0 4 * * *'
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
+  actions: read
   contents: read
 
 jobs:
   scorecard:
     uses: ../../.github/workflows/scorecard-reusable.yml
+    secrets: inherit

a2ml/actions/validate/.github/workflows/scorecard.yml

@@ -4,13 +4,21 @@ name: OSSF Scorecard
 on:
   push:
     branches: [main, master]
+  pull_request:
+    branches: [main, master]
   schedule:
     - cron: '0 4 * * *'
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
+  actions: read
   contents: read
 
 jobs:
   scorecard:
     uses: ../../../.github/workflows/scorecard-reusable.yml
+    secrets: inherit

a2ml/bindings/deno/.github/workflows/scorecard.yml

@@ -4,13 +4,21 @@ name: OSSF Scorecard
 on:
   push:
     branches: [main, master]
+  pull_request:
+    branches: [main, master]
   schedule:
     - cron: '0 4 * * *'
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
+  actions: read
   contents: read
 
 jobs:
   scorecard:
     uses: ../../../.github/workflows/scorecard-reusable.yml
+    secrets: inherit

a2ml/bindings/haskell/.github/workflows/scorecard.yml

@@ -4,13 +4,21 @@ name: OSSF Scorecard
 on:
   push:
     branches: [main, master]
+  pull_request:
+    branches: [main, master]
   schedule:
     - cron: '0 4 * * *'
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
+  actions: read
   contents: read
 
 jobs:
   scorecard:
     uses: ../../../.github/workflows/scorecard-reusable.yml
+    secrets: inherit

a2ml/bindings/rust/.github/workflows/scorecard.yml

@@ -4,13 +4,21 @@ name: OSSF Scorecard
 on:
   push:
     branches: [main, master]
+  pull_request:
+    branches: [main, master]
   schedule:
     - cron: '0 4 * * *'
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
+  actions: read
   contents: read
 
 jobs:
   scorecard:
     uses: ../../../.github/workflows/scorecard-reusable.yml
+    secrets: inherit

a2ml/editors/vscode/.github/workflows/scorecard.yml

@@ -4,13 +4,21 @@ name: OSSF Scorecard
 on:
   push:
     branches: [main, master]
+  pull_request:
+    branches: [main, master]
   schedule:
     - cron: '0 4 * * *'
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
+  actions: read
   contents: read
 
 jobs:
   scorecard:
     uses: ../../../.github/workflows/scorecard-reusable.yml
+    secrets: inherit

a2ml/pandoc/.github/workflows/scorecard.yml

@@ -4,13 +4,21 @@ name: OSSF Scorecard
 on:
   push:
     branches: [main, master]
+  pull_request:
+    branches: [main, master]
   schedule:
     - cron: '0 4 * * *'
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
+  actions: read
   contents: read
 
 jobs:
   scorecard:
     uses: ../../../.github/workflows/scorecard-reusable.yml
+    secrets: inherit