From 0bc18b70bb291b1335897d73cbcb932284a8601a Mon Sep 17 00:00:00 2001
From: Maximiliano Salvatti <40447063+msalvatti@users.noreply.github.com>
Date: Thu, 30 Jul 2026 16:49:38 -0300
Subject: [PATCH] ci(scorecard): namespace the SARIF upload and align the
 action version
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Scorecard SARIF was uploaded without a `category`, so it landed in the
default analysis set — where every upload replaces whatever was there before, and
its findings sit in the Security tab beside CodeQL's with nothing distinguishing
the two tools. `nest-notification` and `nest-cache` both declare
`category: ossf-scorecard`; this brings the third in line.

Also moves `upload-sarif` from 4.37.3 to 4.37.4, the version `init` and `analyze`
already run. The three sub-actions share a release train and there is no reason
for this one to trail — it only trailed because it lives in a different workflow
and was bumped by a separate Dependabot PR.
---
 .github/workflows/scorecard.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 40825a3..a738163 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -76,6 +76,11 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: results.sarif
+          # Namespace the Scorecard results so they form their own analysis set.
+          # Without a category the upload lands in the default one, where each run
+          # replaces whatever was there last and Scorecard findings sit alongside
+          # CodeQL's in the Security tab with nothing to tell them apart.
+          category: ossf-scorecard