[clubanderson]

Option A from #17392: guard the Scorecard job so pushes to non-default release lines are skipped instead of red. Same change on both lines.

Fixes #17392

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

No conflicting open PRs or same-file overlaps were found.

[hivecommons-hive]

Hive status — updated in place; edits do not notify. Full history is in the Activity Monitor.

@clubanderson this PR is held at stage/071-needs-author and the hive will not merge it yet.

Why:

• merge-train:duplicate-of#17415:17392/0:0/0:

Next: the hive does not push to your branch. Push a new head (or reply here); CI and the review swarm re-run automatically and the PR returns to the normal path.

Review findings from reviewer (folded here because this head already carries its hive review):

The workflow change is correct; the PR is red only because of a malformed changelog fragment.

Guard (.github/workflows/scorecard.yml:18): github.event_name != 'push' || github.ref_name == github.event.repository.default_branch. On push, ref_name is the bare branch name and default_branch is v5, so pushes to the non-default lines skip while schedule/workflow_dispatch are untouched. It narrows execution and changes no permissions:. This is Option A exactly as #17392 states it (label approved-direction), so no decision is outstanding.

Blocker — changelog-fragment-guard fails on this head:

changelog.d/fixed-scorecard-default-branch-guard.md: a fragment must start with a '- ' entry bullet

src/scripts/check-changelog-fragment.sh:72-74 rejects any fragment not starting with - or a release marker. The PR carries two fragments; changelog.d/fixed-17414.md is already well-formed, so deleting changelog.d/fixed-scorecard-default-branch-guard.md (or prefixing its line with - ) is the whole fix. Same defect on #17415.

Minor: both PRs say Fixes #17392; whichever merges first closes the issue while the other line is still open. Harmless, noting only so nobody is surprised.

stage 080-awaiting-merge-admission → 050-review-pending: contributor-lane:workflow-path

Evidence bundle `#1741489e9fa6` sha256:8e67f04d639013e3817d61b36cd37256e1773cf7e9725561efbb9a51753daf9d — download from the dashboard or `hivectl review evidence #17414`.

[hivecommons-hive]

The workflow change looks correct to me; the red check is a changelog-fragment format problem, not the code.

Workflow — .github/workflows/scorecard.yml:17-18 adds if: github.event_name != 'push' || github.ref_name == github.event.repository.default_branch on the analysis job. Read against the v5 tree: the trigger is still push: branches: [main, v4, v5, v6] plus schedule/workflow_dispatch, so non-default pushes now skip instead of hitting Only the default branch … is supported, and schedule/dispatch are untouched. This is Option A verbatim from #17392 (labelled approved-direction), so no decision is outstanding. The permissions block is unchanged.

Why changelog-fragment-guard fails — changelog.d/fixed-scorecard-default-branch-guard.md:1 starts with ci: Scorecard push runs …, no - bullet. src/scripts/check-changelog-fragment.sh:71-76 on v5 requires every fragment's first line to begin with - (or a <!-- release: … --> marker) and exits 1 otherwise — that is the exact error in the job log. The second fragment changelog.d/fixed-17414.md is already well-formed and describes the same change, so the simplest fix is to delete fixed-scorecard-default-branch-guard.md (or prefix its line with - and drop the other). Either way the PR should carry one fragment, not two.

Nothing else found. This is a comment, not an approval.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

changelog-fragment-guard is red because changelog.d/fixed-scorecard-default-branch-guard.md has no leading - bullet (guard: "a fragment must start with a '- ' entry bullet"). changelog.d/fixed-17414.md is already valid, so the simplest fix is to delete the duplicate:

git rm changelog.d/fixed-scorecard-default-branch-guard.md

or, if you want to keep it, prefix the line with - . Not pushing to your branch; the sweep merges once CI is green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

55f388e

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @clubanderson, head 55f388e004ba) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/scorecard.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Looks correct to me; this is Option A exactly as #17392 proposed, and the issue already carries approved-direction.

Verified against .github/workflows/scorecard.yml on v5: the push trigger lists main, v4, v5, v6 (line 7), and the new job-level if: (line 18) lets schedule/workflow_dispatch through while skipping pushes whose github.ref_name is not github.event.repository.default_branch (currently v5). No change to the permissions: block or the pinned reusable-workflow SHA. #17415 is the same guard on the v6 line, not a duplicate — the release-lines-in-sync check expects both.

One small thing: the PR ships two changelog fragments for one change — changelog.d/fixed-17414.md and changelog.d/fixed-scorecard-default-branch-guard.md — so the release notes will carry the same bullet twice. If fixed-17414.md was auto-added, the hand-written one is the better of the two to keep. Not blocking.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Needs a decision, not a merge: the PR edits CI workflow / action files: awaiting owner approval — a hive owner / trusted merger's GitHub Approve review on the current head (or a dashboard /hive decision approve) releases the fence and the hive merges it; approval on an earlier head does not count unless the hive's own merge of the base branch is all that moved the head, so re-approve after a push.

Head: verdict approved @55f388e, 68/68 checks green, DCO yes, soak 0s of 10m0s.

How to release it:

• A hive owner / trusted merger submits a GitHub Approve review on the current head (or approves from the Hive dashboard, which posts /hive decision approve on their behalf); that explicit approval releases the workflow-path fence and the lane merges on its next pass once CI, soak and the other gates are clear. Approval on an earlier head carries over only the hive's own merge of the base branch (which leaves the diff unchanged): re-approve after any other push.

_{Clear the cause and the hive re-evaluates on its next pass; the stage moves to stage/090-ready-for-human-merge, stage/095-pre-merge-soak or the merge queue on its own. Approval does not bypass CI, hold labels or other merge gates.}

[hivecommons-hive]

merged by Hive trusted-author auto-merge: author @clubanderson holds role owner and GitHub permission admin on repo; CI green at 89e9fa6.

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback

[hivecommons-hive]

Looks correct to me — this is the v5 line of the same change as #17415 (already reviewed), and the two are byte-identical in .github/workflows/scorecard.yml.

What I checked at base v5:

• .github/workflows/scorecard.yml:16-18 — the new if: on the analysis job is exactly Option A from #17392. github.event.repository.default_branch is populated on push events, and the github.event_name != 'push' short-circuit leaves schedule and workflow_dispatch runs unchanged, as the fragment claims.
• A job-level if: is valid on a uses: (reusable-workflow) job, so the guard applies before the call into hivecommons/infra.
• The push: branches: [ "main", "v4", "v5", "v6" ] trigger is left as-is, which is what Option A intended — non-default pushes show as skipped rather than red.

No defects found. Since the file is under .github/workflows/, a maintainer with workflow-write still needs to land it; nothing further from me.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88