ci: retire redundant scorecard.yml (superseded by scorecard-enforcer.yml)

[hyperpolymath]

Why

.github/workflows/scorecard.yml (the "Scorecards supply-chain security" workflow) has startup_failure'd on every push to main — confirmed across the last several pushes through the latest commit (e4c7d96). It's a thin caller of scorecard-reusable.yml@3f34549c, and the reusable at that pinned SHA is itself valid (I fetched it — identical to main's copy minus the later timeout-minutes line). So this isn't a malformed-file bug; it's a redundant second scorecard run the standards repo doesn't need.

Decision: retire, not repair

scorecard-enforcer.yml (hardened in #371) is a strict superset:

Capability	scorecard.yml (reusable)	scorecard-enforcer.yml
Run OSSF Scorecard	✅	✅
Upload SARIF	✅	✅
Publish to OSSF registry	❌ (reusable doesn't set publish_results)	✅ publish_results: true
Score gate (MIN_SCORE)	❌	✅

The thin-caller→reusable pattern is the estate convention for downstream repos. The standards repo is special — it hosts scorecard-reusable.yml and runs the enforcer, so it doesn't need the thin caller too.

Safety

• No other in-repo references to scorecard.yml (grep clean).
• Not a required status check — pushes have been merging despite its red, so removing it cannot block merges.
• scorecard-reusable.yml is untouched — downstream callers across the estate are unaffected.
• Net: removes a perpetually-red check and a duplicate scorecard run, zero functional loss (publishing + SARIF + gate all remain via the enforcer).

Alternative (rejected)

Repairing the caller's startup_failure and keeping it would preserve the redundant double-run. If you'd rather keep the thin caller as the canonical pattern in this repo too, say so and I'll repair the startup_failure instead of deleting.

Guardrail

No LICENSE file or SPDX header touched.

https://claude.ai/code/session_011xv3VLrqeXkpjXxUojKz82

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 140 issues detected

Severity	Count
🔴 Critical	63
🟠 High	57
🟡 Medium	20

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_workflow",
    "file": "scorecard.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in governance.yml",
    "type": "missing_timeout_minutes",
    "file": "governance.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "missing_timeout_minutes",
    "file": "mirror.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_timeout_minutes",
    "file": "secret-scanner.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Required file missing (condition: public_repo)",
    "type": "missing_requirement",
    "file": ".github/workflows/scorecard.yml",
    "action": "create",
    "rule_module": "cicd_rules",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence