ci(queue): gate Scorecard on repository visibility (green while private)

[msalvatti]

Root cause of the recurring Scorecard failure: OpenSSF Scorecard requires a public repository — its checkout cannot authenticate against this private repo (fatal: repository not found). The earlier checkout-v4 pin only surfaced the underlying private-repo limitation.

Apply the same visibility-gate pattern already used for the CodeQL SARIF upload: a small gate job resolves repos/<repo>.visibility via the API; the analysis job runs only if: needs.gate.outputs.public == 'true'. While private, the analysis is skipped (the run stays green); once the repository is made public, Scorecard runs automatically — no further workflow change.

This matches the project decision to configure everything as if public, with a conditional for what cannot run while private.

[Copilot]

Pull request overview

Updates the Scorecard GitHub Actions workflow to avoid recurring failures in private repositories by gating the OpenSSF Scorecard analysis on repository visibility, keeping runs green until the repository becomes public.

Changes:

• Add a gate job that resolves repos/<repo>.visibility via the GitHub API.
• Run the analysis job only when the gate reports the repository is public.

Comments suppressed due to low confidence (1)

.github/workflows/scorecard.yml:51

• analysis defines job-level permissions, which overrides the workflow-level defaults. Since this job runs actions/checkout, it should explicitly include contents: read (consistent with other workflows like .github/workflows/codeql.yml). Without it, checkout can fail depending on how the token is used.

    needs: gate
    if: ${{ needs.gate.outputs.public == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      id-token: write
    steps:

[msalvatti]

Addressed in the latest commit — the visibility check is now fail-safe: gh api errors are swallowed and default to public=false, so a transient API/CLI failure skips the analysis (keeping the run green) rather than failing the whole workflow.