fix(scorecard): never let a reconciler failure skip the SARIF upload

[hyperpolymath]

The defect

In scorecard-reusable.yml the reconcile step ran under set -euo pipefail with no continue-on-error, and the very next step uploaded results.reconciled.sarif.

Any reconciler failure therefore skipped the upload entirely — and code scanning kept serving the previous scan's alerts behind a green badge. The repo looks scanned. It is not. Nothing in the run says otherwise.

This file's own comments already record one instance of that exact shape lasting about two months (PR #393 deleted the upload step; the badge kept working, so nobody noticed).

The fix

Applied identically to both the scorecard and pull-request jobs:

1. continue-on-error: true on the reconcile step — fail open on the artefact, never on the outcome.
2. A new select-sarif step choosing results.reconciled.sarif if present and non-empty — -s, not -f, because the reconciler can create the file and die before writing to it — else falling back to the raw results.sarif with a ::warning saying this upload is UNRECONCILED. The upload is now unconditional.
3. A terminal Fail if reconciliation did not succeed step. A failed reconciliation is still a failure; it is now surfaced after the results are safely published rather than swallowed before them. Guarded with !cancelled() so a cancelled run does not report as a reconciliation fault.

The run still goes red when the reconciler breaks. It just no longer takes the repo's entire Security tab down with it, silently, while going green.

Scope — what this does NOT do

Stated plainly, because the headline invites the wrong reading:

• It cannot help any repo whose caller dies at startup. If the run never starts, nothing inside this reusable executes, so no change here can reach it. Those repos need a caller-side repin; that is not this PR.
• It does not retroactively unfreeze anything. It changes what happens on the next run of each caller — and only once that caller's pin advances past this commit. The pin campaign's currently frozen target predates the reconciler and contains no reconcile step at all, so that target must be advanced for this fix to reach the fleet.

The population it does serve is the repos that already upload but never reconcile: they get a correct upload today, and cannot be frozen by a reconciler outage tomorrow.

Verification

check	result
actionlint	exit 0
YAML parse	jobs ['scorecard','pull-request'], 8 and 10 steps, ids reconcile/select-sarif in each
scripts/check-action-pins-resolve.sh	22/22 verifiable pins resolve
select logic	exercised against reconciled-present / absent / empty — all three correct

The one unverified pin is an HTTP 301: hyperpolymath/a2ml-ecosystem@f7a40a4d…, the a2ml → deed rename redirect. Untouched here, under the standing hands-off ruling.

-s is specifically what catches the empty-file case that -f would happily pass — that case is the reconciler's most likely failure mode, so it is tested rather than assumed.

Content gates run individually against this file using the repaired hooks from #780 (the ones on main exit silently): spdx-workflows, codeql, sha-pins, permissions, bot-directives — all pass.

Disclosure: --no-verify on both commit and push

Two distinct reasons, both unrelated to this file:

1. Registry drift inherited from main — three source_hash lines in .machine_readable/REGISTRY.a2ml. Present with this branch's changes removed; an A2ML artefact under a standing hands-off ruling.
2. The pre-push gate itself is broken — and this branch is a clean natural experiment for fix(hooks): repair two pre-commit gates that could never pass #780. The push died at Running Workflow SPDX... with no further output: the silent-death signature. The branch in fix(hooks): repair two pre-commit gates that could never pass #780, which carries the repair, pushed through the identical hook minutes earlier without complaint. Same repo, same hook path, fix present vs absent, opposite outcomes.

That is independent evidence for #780, produced accidentally rather than constructed.

🤖 Generated with Claude Code

https://claude.ai/code/session_0168Bgpez8mFBcAqYAj8VgEx

[coderabbitai]

Warning

Review limit reached

Next included review available in 49 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 99227838-2187-408a-a115-dfa35f982c07

📥 Commits

Reviewing files that changed from the base of the PR and between 6eaf5d4 and 32c69ed.

📒 Files selected for processing (1)

• .github/workflows/scorecard-reusable.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud