Observed
The "🔬 OpenSSF Scorecard" workflow's analyze job runs the Scorecard analysis successfully but fails at the results-publish step on every run (most recently on the v1.3.9 master commit 6210b35, job: https://github.com/CLDMV/fix-headers/actions/runs/31298288978/job/93206795342):
error sending scorecard results to webapp: http response 400, status: 400 Bad Request,
error: {"code":400,"message":"workflow verification failed: workflow verification failed: scorecard job
should have exactly 1 'Ubuntu' virtual environment, see
https://github.com/ossf/scorecard-action#workflow-restrictions for details."}
Non-blocking — doesn't gate CI, the release PR, or publishing — but the public OSSF badge / transparency-log submission never lands, so the README badge is silently stale.
Root cause — tracked upstream, not actionable here
This repo's .github/workflows/scorecard.yml is a thin caller that delegates the analysis to CLDMV/.github/.github/workflows/reusable-scorecard.yml@v4. The root cause is very likely in how that reusable workflow is invoked (a uses: reusable-workflow call rather than an inline job), which appears to break ossf/scorecard-action's server-side workflow verification for the publish_results: true path. Full analysis and suggested fix directions are on the upstream issue:
CLDMV/.github#217
Nothing to fix in this repo's own scorecard.yml — it's already the standard thin-caller pattern every other CLDMV repo uses.
scorecard.yml here only triggers on push: [master, main], branch_protection_rule, and a weekly schedule — fixing the reusable workflow alone won't retrigger it. Once the @v4 tag on CLDMV/.github picks up the fix, this repo needs a fresh push to master to confirm the badge actually goes green — a trivial/thin patch release here (or a manual workflow_dispatch re-run of scorecard.yml) is enough; no code change is required.
Observed
The "🔬 OpenSSF Scorecard" workflow's
analyzejob runs the Scorecard analysis successfully but fails at the results-publish step on every run (most recently on the v1.3.9 master commit6210b35, job: https://github.com/CLDMV/fix-headers/actions/runs/31298288978/job/93206795342):Non-blocking — doesn't gate CI, the release PR, or publishing — but the public OSSF badge / transparency-log submission never lands, so the README badge is silently stale.
Root cause — tracked upstream, not actionable here
This repo's
.github/workflows/scorecard.ymlis a thin caller that delegates the analysis toCLDMV/.github/.github/workflows/reusable-scorecard.yml@v4. The root cause is very likely in how that reusable workflow is invoked (auses:reusable-workflow call rather than an inline job), which appears to breakossf/scorecard-action's server-side workflow verification for thepublish_results: truepath. Full analysis and suggested fix directions are on the upstream issue:CLDMV/.github#217
Nothing to fix in this repo's own
scorecard.yml— it's already the standard thin-caller pattern every other CLDMV repo uses.Follow-up once CLDMV/.github#217 is resolved
scorecard.ymlhere only triggers onpush: [master, main],branch_protection_rule, and a weeklyschedule— fixing the reusable workflow alone won't retrigger it. Once the@v4tag onCLDMV/.githubpicks up the fix, this repo needs a fresh push tomasterto confirm the badge actually goes green — a trivial/thin patch release here (or a manualworkflow_dispatchre-run ofscorecard.yml) is enough; no code change is required.