From d13c091c23ffe3df071f5831bcdbd37111aaa69d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 6 Oct 2026 18:19:49 +0100 Subject: [PATCH] fix(scorecard): run the per-file reconciler and name exit 3 honestly scorecard-reusable.yml checked the reconciliation helper out at 591cea1b, which predates #1168 (per-file verification) and #1064 (stale-tolerance). Neither fix had ever run in CI. Bump the helper ref in both jobs to 5a0891e9, the #1168 merge. The reconcile step now passes its exit code on as `rc`. When the helper exits 3, the reconciled SARIF was written and uploaded, and only the workflows that failed native lock verification keep their findings. The final step said "Raw SARIF was uploaded" in that case, which was false. It now says so only when the raw file really was uploaded. Both cases still fail the run. Refs #1036 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm --- .github/workflows/scorecard-reusable.yml | 34 +++++++++++++++++++----- 1 file changed, 28 insertions(+), 6 deletions(-) diff --git a/.github/workflows/scorecard-reusable.yml b/.github/workflows/scorecard-reusable.yml index 7fa7240c5..c474a62df 100644 --- a/.github/workflows/scorecard-reusable.yml +++ b/.github/workflows/scorecard-reusable.yml @@ -55,7 +55,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: hyperpolymath/standards - ref: 591cea1b074b56367f25ec0084a0c4ab66b42a7e + ref: 5a0891e9e58b785181a92e141505ca96ca987b42 # per-file reconciliation (#1168) path: .standards-scorecard persist-credentials: false sparse-checkout: scripts/reconcile-scorecard-actions-lock.rb @@ -76,8 +76,15 @@ jobs: run: | set -euo pipefail gh extension install github/gh-actions-lock --pin v0.1.6 + # Exit 3: the reconciled SARIF was written, but some workflows failed + # native lock verification and keep their findings. Exit 2: usage or + # SARIF-structure error, nothing written. The code is passed on so + # the final step can say which one happened. + rc=0 ruby .standards-scorecard/scripts/reconcile-scorecard-actions-lock.rb \ - results.sarif results.reconciled.sarif actions-lock-audit.json + results.sarif results.reconciled.sarif actions-lock-audit.json || rc=$? + printf 'rc=%s\n' "$rc" >> "$GITHUB_OUTPUT" + exit "$rc" - name: Select SARIF to upload id: select-sarif @@ -112,7 +119,11 @@ jobs: - name: Fail if reconciliation did not succeed if: "!cancelled() && (steps.reconcile.outcome != 'success' || steps.select-sarif.outputs.reconciled != 'true')" run: | - echo "::error title=Scorecard reconciliation failed::Reconcile step outcome was '${{ steps.reconcile.outcome }}'. Raw SARIF was uploaded so results are not lost, but this run fails by design." + if [ "${{ steps.reconcile.outputs.rc }}" = "3" ] && [ "${{ steps.select-sarif.outputs.reconciled }}" = "true" ]; then + echo "::error title=Scorecard reconciliation incomplete::Reconciled SARIF was uploaded. Workflows that failed native action-lock verification keep their findings; the reconcile step log names each one. This run fails by design." + else + echo "::error title=Scorecard reconciliation failed::Reconcile step outcome was '${{ steps.reconcile.outcome }}' (exit '${{ steps.reconcile.outputs.rc }}'). Raw SARIF was uploaded so results are not lost, but this run fails by design." + fi exit 1 pull-request: @@ -188,7 +199,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: hyperpolymath/standards - ref: 591cea1b074b56367f25ec0084a0c4ab66b42a7e + ref: 5a0891e9e58b785181a92e141505ca96ca987b42 # per-file reconciliation (#1168) path: .standards-scorecard persist-credentials: false sparse-checkout: scripts/reconcile-scorecard-actions-lock.rb @@ -209,8 +220,15 @@ jobs: run: | set -euo pipefail gh extension install github/gh-actions-lock --pin v0.1.6 + # Exit 3: the reconciled SARIF was written, but some workflows failed + # native lock verification and keep their findings. Exit 2: usage or + # SARIF-structure error, nothing written. The code is passed on so + # the final step can say which one happened. + rc=0 ruby .standards-scorecard/scripts/reconcile-scorecard-actions-lock.rb \ - results.sarif results.reconciled.sarif actions-lock-audit.json + results.sarif results.reconciled.sarif actions-lock-audit.json || rc=$? + printf 'rc=%s\n' "$rc" >> "$GITHUB_OUTPUT" + exit "$rc" - name: Select SARIF to upload id: select-sarif @@ -245,5 +263,9 @@ jobs: - name: Fail if reconciliation did not succeed if: "!cancelled() && (steps.reconcile.outcome != 'success' || steps.select-sarif.outputs.reconciled != 'true')" run: | - echo "::error title=Scorecard reconciliation failed::Reconcile step outcome was '${{ steps.reconcile.outcome }}'. Raw SARIF was uploaded so results are not lost, but this run fails by design." + if [ "${{ steps.reconcile.outputs.rc }}" = "3" ] && [ "${{ steps.select-sarif.outputs.reconciled }}" = "true" ]; then + echo "::error title=Scorecard reconciliation incomplete::Reconciled SARIF was uploaded. Workflows that failed native action-lock verification keep their findings; the reconcile step log names each one. This run fails by design." + else + echo "::error title=Scorecard reconciliation failed::Reconcile step outcome was '${{ steps.reconcile.outcome }}' (exit '${{ steps.reconcile.outputs.rc }}'). Raw SARIF was uploaded so results are not lost, but this run fails by design." + fi exit 1