Repository navigation
Spike: can scorecard run as a reusable workflow? #37
Description
Context
We want consumer repos to call the governance workflows from dev-kit instead of carrying copies. scorecard is the one we're unsure about: with publish_results: true, ossf/scorecard-action checks the workflow file it runs in, and may reject being called through workflow_call.
The answer decides whether scorecard becomes a reusable workflow or stays a standalone file in each repo, so it blocks the design of the caller stubs.
What needs to be solved
Try scorecard as a reusable workflow called from a test repo, with publish_results: true. Timebox: half a day.
Acceptance criteria
- Decision recorded here: reusable or standalone, with the error output or docs reference that backs it.
Activity
dermorz commentedon Sep 25, 2026
Decision:
scorecardstays a standalone workflow in each repo. No PoC; existing reports answer the question.With
publish_results: true, the scorecard API verifies the job that runs the action: only allowlisted actions as steps, a single literal Ubuntu runner, no top-levelenv/defaultsor write permissions (scorecard-action README). Reusable workflows are nominally supported, but other projects have hit exactly this verification with a thin caller stub:main)Why not centralize anyway:
scorecard.ymlrarely changes and Renovate already keeps its pins current, so the gain is small. The failure mode is a silently stale Scorecard result rather than a red build. Revisit if reusable-workflow support in scorecard matures.For #38: no
scorecardstub; consumers keep their ownscorecard.yml.feat!: make governance workflows reusable (#41)