From 2d5ae747e48a98e9126d96f62118496e15b56ec3 Mon Sep 17 00:00:00 2001
From: Michael Pursifull <mike@arcaven.com>
Date: Fri, 17 Jul 2026 12:00:44 -0500
Subject: [PATCH] ci: guard scorecard behind SCORECARD_ENABLED repo var
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Scorecard analysis is now opt-in: the job runs only when the repo
variable SCORECARD_ENABLED is set to true (same opt-in pattern as
SIGNING_ENABLED). No var, no run — forks and clones stay quiet by
default.
---
 .github/workflows/scorecards.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index aac7e81b..e938d3bf 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -20,6 +20,10 @@ permissions: read-all
 jobs:
   analysis:
     name: Scorecard analysis
+    # Default off — enable by setting repo variable SCORECARD_ENABLED=true
+    # (same opt-in pattern as SIGNING_ENABLED). Keeps forks from running
+    # scorecard unintentionally.
+    if: vars.SCORECARD_ENABLED == 'true'
     runs-on: ubuntu-latest
     permissions:
       # Needed to upload the results to code-scanning dashboard.