From c432f4af2b70d2547601d90f2d0bd330fb988927 Mon Sep 17 00:00:00 2001
From: Maximiliano Salvatti <40447063+msalvatti@users.noreply.github.com>
Date: Sat, 27 Jun 2026 06:53:28 -0300
Subject: [PATCH 1/2] ci(queue): gate Scorecard on repo visibility so it passes
 while private

---
 .github/workflows/scorecard.yml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 90dccb3..f320d70 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -11,8 +11,39 @@ permissions:
   contents: read
 
 jobs:
+  # OpenSSF Scorecard requires a public repository — its checkout cannot authenticate
+  # against a private repo. Gate the analysis on visibility so the workflow stays green
+  # (the analysis job is skipped) while the repository is private, and runs automatically
+  # once the repository becomes public — no workflow change required.
+  gate:
+    name: Resolve repository visibility
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      public: ${{ steps.vis.outputs.public }}
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
+
+      - name: Determine visibility
+        id: vis
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          visibility="$(gh api "repos/${{ github.repository }}" --jq '.visibility')"
+          if [ "$visibility" = "public" ]; then
+            echo 'public=true' >> "$GITHUB_OUTPUT"
+          else
+            echo 'public=false' >> "$GITHUB_OUTPUT"
+          fi
+
   analysis:
     name: Scorecard analysis
+    needs: gate
+    if: ${{ needs.gate.outputs.public == 'true' }}
     runs-on: ubuntu-latest
     permissions:
       security-events: write

From 9d04d2456e8f140cc8b51f9c5ae9e60a6572a6e8 Mon Sep 17 00:00:00 2001
From: Maximiliano Salvatti <40447063+msalvatti@users.noreply.github.com>
Date: Sat, 27 Jun 2026 06:59:30 -0300
Subject: [PATCH 2/2] ci(queue): make Scorecard visibility check fail-safe to
 private on API error

---
 .github/workflows/scorecard.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index f320d70..94a972c 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -33,8 +33,10 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          visibility="$(gh api "repos/${{ github.repository }}" --jq '.visibility')"
-          if [ "$visibility" = "public" ]; then
+          # Fail safe: any API/CLI error defaults to private, so a transient gh failure
+          # skips the analysis (run stays green) instead of failing the whole workflow.
+          if visibility="$(gh api "repos/${{ github.repository }}" --jq '.visibility' 2>/dev/null)" \
+            && [ "$visibility" = "public" ]; then
             echo 'public=true' >> "$GITHUB_OUTPUT"
           else
             echo 'public=false' >> "$GITHUB_OUTPUT"