chore(ci): make Scorecard periodic, not per-push

[hyperpolymath]

Makes the OpenSSF Scorecard workflow periodic by dropping its push (and, in one repository, pull_request) trigger. schedule, workflow_dispatch and branch_protection_rule are all kept.

Why. Scorecard measures the repository's supply-chain posture, not the change under review. That is the 📅 PERIODIC: tier in the estate's signal-discipline standard: on a schedule against the default branch, feeding a dashboard — not on every event. It cannot meaningfully pass or fail a diff.

Measured across 303 scorecard workflows before this sweep:

199  push, schedule, workflow_dispatch
 93  branch_protection_rule, schedule, push
  1  push, pull_request, schedule, workflow_dispatch
  1  schedule, workflow_dispatch          <- the target shape

So ~292 repositories ran a full posture scan on every push to the default branch. That is pure cost: the score cannot meaningfully change between two consecutive merges.

Deliberately kept: branch_protection_rule. It fires on a settings change — not per pull request — so it does not violate the PERIODIC rule, and it re-measures precisely what Scorecard scores after exactly the change most likely to alter it.

🤖 Generated with Claude Code

[gitar-bot]

CI failed: CI workflow failures due to the `just` command-line task runner missing from the runner environment.

Overview

Two jobs failed because the just command-line task runner is not installed in the CI runner environment before attempting to run just build-site.

Failures

Missing just Task Runner (confidence: high)

• Type: tooling
• Affected jobs: 92607810956, 92607811026
• Related to change: yes
• Root cause: The CI workflow attempts to execute just build-site, but the just utility is not installed on the runner.
• Suggested fix: Add a step to install just (such as using extractions/setup-just or package managers) prior to invoking just commands in the workflow.

Summary

• Change-related failures: 2 jobs failed due to missing tooling (just not installed).
• Infrastructure/flaky failures: 0 failures.
• Recommended action: Update the CI workflow configuration to install the just utility before running build steps.

Code Review ✅ Approved

Updates the OpenSSF Scorecard workflow to run periodically on a schedule and branch protection rules, dropping push and pull_request triggers to eliminate redundant scans. No issues found.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

---

Important

Your trial ends in 7 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}