v3.11.1
release: v3.11.1 - call reusable-scorecard.yml@v4 instead of inline job (#174)
Slothlet v3.11.1 Changelog
Release Date: June 2026
Release Type: Patch
Branch: release/3.11.1
Overview
A CI-only patch that fixes OpenSSF Scorecard publishing. The Scorecard workflow was the last slothlet workflow still running an inline analysis job; its checkout step used a CLDMV/.github composite action that Scorecard's publish-verification step rejects, so results never reached the transparency log. The workflow is migrated to the org reusable reusable-scorecard.yml@v4. This release ships no source, API, or published-package changes — only a repository CI workflow.
Compatibility. No API, runtime, or published-package changes.
🐛 Bug Fixes
CI: OpenSSF Scorecard publish failed with HTTP 400 (#173)
The Scorecard workflow ran an inline analysis job whose checkout step used the CLDMV/.github checkout-code composite action. Scorecard's publish step verifies the analysis job against a fixed allowlist of steps and rejects custom or composite actions, so publishing to the transparency log failed:
workflow verification failed: job has unallowed step:
CLDMV/.github/.github/actions/common/steps/checkout-code
This workflow predated reusable-scorecard.yml (added to CLDMV/.github after this file) and was the only slothlet workflow still inlined rather than a thin caller. It now calls the org reusable reusable-scorecard.yml@v4, which uses actions/checkout directly (passing verification) and centralizes the SHA-pinned scorecard-action version so it cannot drift in a local copy.
📚 Documentation
- NEW: docs/changelog/v3/v3.11.1.md — this changelog.
- README — refreshed What's New.
Upgrade notes
No action required — this release contains no source or API changes, only a CI workflow fix.
