From b92930b6177ad2fe06e92581da815b1d070686e4 Mon Sep 17 00:00:00 2001
From: Michael Pursifull <mike@arcaven.com>
Date: Fri, 17 Jul 2026 11:59:48 -0500
Subject: [PATCH] ci: guard scorecard behind SCORECARD_ENABLED repo var

Scorecard analysis is now opt-in: the job runs only when the repo
variable SCORECARD_ENABLED is set to true (same opt-in pattern as
SIGNING_ENABLED). No var, no run.
---
 .github/workflows/scorecards.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 1cb9205..b3efdeb 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -20,6 +20,9 @@ permissions: read-all
 jobs:
   analysis:
     name: Scorecard analysis
+    # Default off — enable by setting repo variable SCORECARD_ENABLED=true
+    # (same opt-in pattern as SIGNING_ENABLED).
+    if: vars.SCORECARD_ENABLED == 'true'
     runs-on: ubuntu-latest
     permissions:
       # Needed to upload the results to code-scanning dashboard.