Remove duplicate OpenSSF Scorecard workflow (scorecard-enforcer.yml)#184
Merged
Conversation
scorecard-enforcer.yml runs a second, self-contained OpenSSF Scorecard
scan that duplicates the scan already performed by scorecard.yml, which
delegates to the shared hyperpolymath/standards scorecard reusable
workflow. Running both executes the (expensive) Scorecard scan twice on
every push.
The governance "Check Workflow Staleness" gate explicitly requires
removing this legacy file ("Remove legacy scorecard-enforcer.yml").
The single reusable-workflow scan in scorecard.yml is retained.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0196movYBRwNw8vkLRaaFoTu
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Removes the legacy
.github/workflows/scorecard-enforcer.yml.Why
This repo runs the OpenSSF Scorecard scan twice on every push:
scorecard.yml— delegates to the sharedhyperpolymath/standardsscorecard reusable workflow (the modern, canonical path), and
scorecard-enforcer.yml— a legacy self-contained job that runs its ownfull Scorecard scan + SARIF upload again.
The governance Check Workflow Staleness gate explicitly requires this:
Deleting the enforcer leaves a single Scorecard scan (via the reusable
workflow) and removes the redundant Actions run.
Note (separate follow-up)
The same staleness gate also asks to refresh the Hypatia + Scorecard reusable
pins to the current
hyperpolymath/standardsSHA. That needs read accessto
hyperpolymath/standards(not in this session's scope), so it's left as afollow-up — the staleness check may stay red on those pin items until then.
This PR addresses only the duplicate-scan removal.
🤖 Generated with Claude Code
https://claude.ai/code/session_0196movYBRwNw8vkLRaaFoTu
Generated by Claude Code