chore(ci): make Scorecard periodic — drop push and pull_request triggers

hyperpolymath · claude · hyperpolymath · commit 6cec9ff6db9c · 2026-08-06T11:18:07.000+01:00
Scorecard measures the REPOSITORY's supply-chain posture, not the change under
review. The estate's signal-discipline standard puts repository-level
measurements in the PERIODIC tier: on a schedule against the default branch,
feeding one dashboard — not on every event.

Measured across 303 scorecard workflows before this sweep:

  199  push, schedule, workflow_dispatch
   93  branch_protection_rule, schedule, push
    1  push, pull_request, schedule, workflow_dispatch
    1  schedule, workflow_dispatch                        &lt;- the target shape

So roughly 292 repositories ran a full posture scan on EVERY push to the
default branch. That is pure cost: a supply-chain score cannot meaningfully
change between two consecutive merges, and it never gated anything.

WHAT IS DELIBERATELY KEPT:

  schedule                the point of the tier
  workflow_dispatch       manual re-run when one is actually wanted
  branch_protection_rule  event-driven re-measurement of precisely what
                          Scorecard scores. It fires on a settings change, not
                          per pull request, so it does not violate the PERIODIC
                          rule — and it keeps the score honest after exactly
                          the change most likely to alter it.

Only `push` and `pull_request` are removed. `pull_request` existed in one
repository and was the genuine violation; `push` was the cost.

Related, and the reason this matters beyond minutes: Scorecard was ALSO
required as a `code_scanning` tool in 78 repositories at alertsThreshold=all,
while producing code-scanning results in essentially none — because it does not
emit per-commit SARIF. That made it an estate-wide merge blocker asking to do
something it does not do. Those requirements have been removed separately.

Co-Authored-By: Claude Fable 5 &lt;noreply@anthropic.com&gt;
Signed-off-by: Jonathan D.A. Jewell &lt;6759885+hyperpolymath@users.noreply.github.com&gt;
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -5,8 +5,6 @@ on:
   branch_protection_rule:
   schedule:
     - cron: '23 4 * * 1'
-  push:
-    branches: [main]
 
 permissions: read-all
 
