ci: fix boj-build secrets-in-if + Scorecard enforcer#55
Merged
Conversation
boj-build.yml: removed the job-level `if:` referencing secrets.BOJ_SERVER_URL.
The `secrets` context is not available in `if:` — referencing it invalidates
the whole workflow. The trigger step already shell-guards on an empty BOJ_URL
and exits 0, so an unconfigured repo stays a fast no-op (honouring the
documented secret-or-var configuration).
scorecard-enforcer.yml: the scorecard job invoked ossf/scorecard-action with
publish_results: true AND a run: step in the same job, which OSSF rejects with
HTTP 400 ("scorecard job must only have steps with `uses`"), failing the run.
Split into an uses-only publish job + an unprivileged JSON score-gate (reads
top-level `.score`; the SARIF aggregate path is absent so the old gate always
read 0 and failed < 5). Least-privilege contents:read, timeouts, SHA pins.
https://claude.ai/code/session_01VwbFNQJw23tW8tqM7utWku
hyperpolymath
marked this pull request as ready for review
June 15, 2026 12:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Two inlined workflows could not validate / pass on
main.boj-build.yml—secretsinif:jobs.trigger-boj.ifreferencedsecrets.BOJ_SERVER_URL != ''. Thesecretscontext is not available inif:— referencing it invalidates the whole workflow.Fix: removed the job-level
if:. The trigger step already shell-guards on an emptyBOJ_URL(set -euo pipefail; explicit empty check;exit 0), so an unconfigured repo stays a fast no-op — and this honours the documented "secret or variable" enablement, which avars-only gate would silently break.scorecard-enforcer.yml— OSSF publish + run-step (HTTP 400) and an unreadable scorescorecardjob ranossf/scorecard-actionwithpublish_results: trueand arun:step in the same job; OSSF rejects that with HTTP 400 ("scorecard job must only have steps withuses")..runs[0].tool.driver.properties.score, which SARIF does not carry → it always read0and failed the< 5check.Fix: split into an uses-only publish job + an unprivileged
score-gatejob that re-derives the score in JSON mode (top-level.score). Also: least-privilegecontents: read, bounded timeouts, canonical SHA pins. (Both failure modes verified live onnextgen-languagesscorecard-enforcer run 27468148000.)Verification
Both files validated as parseable YAML (
yaml.safe_load). These workflows trigger on push-to-main(notpull_request), so the green proof lands after merge.https://claude.ai/code/session_01VwbFNQJw23tW8tqM7utWku
Generated by Claude Code