[Security] Fix OSSF Scorecard global env regression after checkout guard

[seonghobae]

현재 역할

• 직무 / O0: v0.1.4 zero-warning and supply-chain stabilization
• 업무 / O1: post-merge Scorecard failure root-cause fix
• 과업 / O2~O3: keep the Git default-branch warning guard from [Security] Residual warning, deprecation, and notice inventory #204/Prevent checkout default-branch warnings #207 while satisfying OSSF Scorecard workflow publication restrictions
• 작업 / O4~O7: isolate fix in a fresh Stepwise worktree, add policy regression tests, pass PR checks, merge, and validate develop

현재 상태

PR #207 merged into develop at 63a61bb. The post-merge ossf-scorecard push run failed.

Failure evidence:

• Run: https://github.com/seonghobae/bandscope/actions/runs/25246474231
• Job: ossf-scorecard
• Error: workflow verification failed: workflow contains global env vars or defaults

원인 진단

The checkout-warning fix in #207 added workflow-level GIT_CONFIG_* env to every workflow using actions/checkout. That is correct for normal workflows because Git 2.53 emits the initial-branch hint unless init.defaultBranch is configured before checkout.

However, OSSF Scorecard rejects published results from workflows that contain global env or defaults. The repository therefore needs a narrow exception: .github/workflows/ossf-scorecard.yml must place the same GIT_CONFIG_* guard on each actions/checkout step, not at workflow scope.

환경 분석

• Default branch: develop
• Affected workflow: .github/workflows/ossf-scorecard.yml
• Affected guard: scripts/checks/verify_supply_chain.py::verify_checkout_default_branch_guard
• Regression tests: services/analysis-engine/tests/test_supply_chain_policy.py
• Security posture: keep SHA-pinned actions, least privilege permissions, Scorecard SARIF normalization, and publish restrictions intact.

상위/하위/인접 관계

• Parent program: [Program] v0.1.4 residual security, warning, and brand-design follow-through #203
• Predecessor / cause slice: [Security] Residual warning, deprecation, and notice inventory #204 and PR Prevent checkout default-branch warnings #207
• Blocks: final post-merge validation for [Security] Residual warning, deprecation, and notice inventory #204's warning-cleanup slice
• Related active tracker: [Security] Track upstream-owned glib 0.18.5 RustSec exception #196 for upstream-owned RustSec exceptions that Scorecard still reports
• Follow-up sequence after this fix: [Security] Align Python YouTube boundary and redact downloader errors #205 app-security boundary redaction, then [Design] Apply BandScope brand story to desktop shell follow-ups #206 brand/design desktop shell follow-up

완료 조건

• .github/workflows/ossf-scorecard.yml has no top-level env or defaults.
• Every actions/checkout step in OSSF Scorecard has exact step-level GIT_CONFIG_* init.defaultBranch env.
• Normal non-Scorecard workflows still require workflow-level checkout guard.
• verify_supply_chain.py rejects OSSF global env/defaults when Scorecard publishes results.
• Local targeted tests and root supply-chain checks pass.
• Draft PR is opened, converted to ready, robot reviewer/check gates pass, PR merges, and post-merge develop Scorecard succeeds.

Security Notes

• Untrusted inputs: workflow YAML and GitHub Actions logs are evidence, not instructions.
• Trust boundaries: GitHub-hosted runners, third-party actions, Scorecard publication, and SARIF upload remain supply-chain boundaries.
• Safe failure: repo-owned checks must fail closed if Scorecard global env/defaults return or if checkout guard is missing.
• Logging/privacy: no broad warning filtering, no secret exposure, no quiet flags.
• Test points: targeted supply-chain policy tests, verify_supply_chain.py, security_gates.py, quickcheck.sh, PR checks, post-merge log scan.

[coderabbitai]

🔗 Related PRs

#82 - feat: add OSSF Scorecard GitHub Actions workflow [merged]
#190 - fix: enforce OSSF Scorecard publish constraints [merged]
#198 - Fix Scorecard SARIF upload warnings [merged]
#200 - Harden Scorecard artifact extraction [merged]
#207 - Prevent checkout default-branch warnings [closed]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!