feat(governance): add scorecard-reusable.yml — close 5-candidate convergence set

[hyperpolymath]

Summary

5th and final reusable in the workflow convergence campaign (see #199 for the meta-doc). Consolidates the per-repo scorecard.yml workflow.

Drift signal (full pagination + per-repo verified)

• 258 top-level estate deployments
• 626 nested copies in monorepos (asdf-tool-plugins, developer-ecosystem, ssg-collection, standards, ambientops, julia-ecosystem, etc. — Layer-2 truncation discovery via tooling(scripts): nested-path support — Git Tree helper + classifier consumers #204's helper)
• 46 unique blob SHAs / 17.8% structural drift
• Top SHA covers 100/258 (38.8%) — highest dominant-cluster of the 5 campaigns
• Top 7 SHAs cover ~80%
• 100% mechanical drift, ZERO feature variance — SPDX header (PMPL-1.0 / PMPL-1.0-or-later / MPL-2.0), upload-sarif SHA-pin churn, permissions: read-all vs contents: read wording

Design

• One input: runs-on (default ubuntu-latest)
• No secrets: inherit — Scorecard uses GITHUB_TOKEN directly
• Caller MUST grant security-events: write + id-token: write on the calling job (called-workflow permissions are capped by caller)
• Caller keeps own on: triggers + concurrency: group

Per Layer-3 caveat from the campaign meta-doc

Nested workflows are inert — GitHub Actions only runs .github/workflows/ at the repo root. Sweeping the 626 nested copies is single-source-of-truth cleanup, not security hardening.

Campaign convergence set (closes with this PR)

PR	Template
#187	mirror-reusable.yml
#190	secret-scanner-reusable.yml
#192	codeql-reusable.yml
#193	hypatia-scan-reusable.yml
#194	sweep-classifier scripts
#199	campaign meta-doc
#204	list-workflow-paths.sh (bypass /search/code undercount)
this	scorecard-reusable.yml

Test plan

• Wrapper sweep (~258 top-level + ~626 nested) — owner-gated; not part of this PR
• Update classify-* scripts to consume helper TSV — follow-up

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 118 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "deno-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence