fix(ci): resolve Scorecard startup_failure and zero-job workflows

.github/workflows/clusterfuzzlite.yml

@@ -12,8 +12,8 @@ on:
     - crates/**
     - fuzz/**
   schedule:
-  - cron: 0 2 * * 0
-  workflow_dispatch: null
+  - cron: '0 2 * * 0'
+  workflow_dispatch:
 
 permissions: read-all
 

.github/workflows/governance.yml

@@ -16,4 +16,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329

.github/workflows/hypatia-scan.yml

@@ -21,5 +21,5 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit

.github/workflows/merge-orchestrate.yml

@@ -16,10 +16,10 @@
 name: Merge Orchestrate (scheduled)
 
 on:
-  workflow_dispatch: null
+  workflow_dispatch:
   schedule:
   # Hourly, offset off the top of the hour to dodge runner congestion.
-  - cron: 17 * * * *
+  - cron: '17 * * * *'
 
 concurrency:
   group: ${{ github.workflow }}

.github/workflows/mirror.yml

@@ -14,5 +14,5 @@ permissions:
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit

.github/workflows/quality.yml

@@ -8,7 +8,7 @@ name: Docs & Code Quality
 on:
   push: null
   pull_request: null
-  workflow_dispatch: null
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/release.yml

@@ -7,7 +7,7 @@ name: Release & Container
 
 on:
   push: null
-  workflow_dispatch: null
+  workflow_dispatch:
 
 permissions: read-all
 

.github/workflows/scorecard.yml

@@ -18,8 +18,9 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
     permissions:
+      actions: read
       contents: read
       security-events: write
       id-token: write

.github/workflows/secret-scanner.yml

@@ -21,5 +21,5 @@ jobs:
       contents: read
       pull-requests: write
       actions: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@db12a6ad3ef9076d5f7bdcf98d7d15cf8547555a
     secrets: inherit

.github/workflows/security-policy.yml

@@ -15,9 +15,9 @@ on:
     - develop
     - main
   schedule:
-  - cron: 0 2 * * *
-  - cron: 0 3 * * 1
-  workflow_dispatch: null
+  - cron: '0 2 * * *'
+  - cron: '0 3 * * 1'
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/tests.yml

@@ -10,12 +10,12 @@ on:
     branches:
     - main
   pull_request: null
-  workflow_dispatch: null
+  workflow_dispatch:
   schedule:
   # Daily 03:00 UTC — covers Mondays too. The Monday-only `0 3 * * 1`
   # cron from the pre-consolidation tests was a subset of the daily one
   # and was dropped to stop running this workflow twice on Mondays.
-  - cron: 0 3 * * *
+  - cron: '0 3 * * *'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/verify-proofs.yml

@@ -37,8 +37,8 @@ on:
   # 04:30, 05:00) were inherited from the pre-consolidation
   # verify-{idris,lean,tlaplus}.yml workflows and fired the now-merged
   # workflow three times every Monday. Collapsed to one.
-  - cron: 0 4 * * 1
-  workflow_dispatch: null
+  - cron: '0 4 * * 1'
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}