From f3777ffb87080e3e7e993b27d2c86a81e634e6ff Mon Sep 17 00:00:00 2001
From: askalf <263217947+askalf@users.noreply.github.com>
Date: Sun, 1 Nov 2026 15:14:47 -0500
Subject: [PATCH] scorecard: check out with actions/checkout so results publish

---
 .github/workflows/scorecard.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 794a7f5..ff0e81c 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -24,7 +24,9 @@ jobs:
       id-token: write # required by publish_results (OIDC attestation)
     steps:
       - name: Checkout code
-        uses: askalf/ci/actions/checkout-with-retry@5305beec29bdd65ff79d5b431d8c3a25fe945bb1 # main 2026-11-01, askalf/ci#141
+        # Scorecard publishes only from a workflow whose steps it recognises, so the checkout is
+        # actions/checkout itself; this job runs on a hosted runner, which needs no retry.
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false