build(scorecard): bump SARIF uploader to 4.38.0 on current main

[seonghobae]

Purpose

Carry the still-valid Scorecard SARIF uploader update on the current protected Wardnet base without importing stale ancestry, while keeping the local Scorecard evidence contract explicit.

Protected/default main is f8260f1e03836039ff9463dd99fa982e4e270c4b. The immutable github/codeql-action v4.38.0 tag resolves to b96794f015dfd88f77b49b1c93e0fa7110f94c63.

Current exact head is 158195e98d1ef26f81b5feb7046ef7495a250bf5. The net diff against protected main is intentionally narrow:

• .github/workflows/scorecard-analysis.yml: upload-sarif moves from ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd to immutable v4.38.0 b96794f015dfd88f77b49b1c93e0fa7110f94c63.
• tests/workflow_queue_contract.rs: retain the supported non-PR Scorecard event contract and explicitly require security-events: write.

Runner, default-branch triggers, checkout pin, Scorecard pin, SARIF path, and runtime behavior are otherwise unchanged.

#362 experiment and repair

Issue #362 identified a real GHAS PR comparison warning for the local Scorecard configuration. A hostile contract RED was introduced at 455d8c045d517dfe8b3ddf2d8ad57c0ffb9ed4d0; CI failed as intended while production behavior was unchanged.

A bounded same-repository pull_request hypothesis at 8be149733582684b59012e0eb6f9c6426dffd77f executed successfully (Scorecard Analysis run 34704152220; rust check 103581041468 GREEN), but GitHub Advanced Security still reported Scorecard check 103581117218 as neutral with two configurations missing (supply-chain/branch-protection, supply-chain/online-scm). Because PR-side SARIF did not restore configuration identity, that experimental trigger was rejected and normally reverted at the current exact head. No pull_request_target, permission broadening, no-op redispatch commit, or gate weakening was retained.

#362 stays open for a GitHub/Scorecard-supported configuration-identity solution. This PR remains the sole writer for the local Scorecard workflow and does not copy organization-owned reusable workflow logic.

Successor / single-writer repair

#141 remains predecessor evidence until this successor is proven complete. #174 carries the valid dependency delta on current protected ancestry. Do not routinely close the predecessor merely because this Draft exists; retire it only after protected truth or another verified complete successor preserves the full valid delta.

Central delegated-verdict ownership remains with .github#1929; the generic solo-maintainer approval defect remains .github#772. Neither is copied into Wardnet or treated as a reason to weaken Wardnet gates.

Exact-head integration gate

Keep Draft until the unchanged exact head has fresh protected-base compatibility, zero valid unresolved findings/threads, an accepted independent approval path, and every live deterministic/security/SAST/CodeQL/coverage/package/SBOM/provenance/governance requirement terminal-valid. No force push, destructive rebase, stale/predecessor evidence promotion, mutable foreign dependency, source copy, cross-service SQL, self-approval, gate weakening, or routine administrator bypass.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh owner handoff: #362 records a newly reproduced Wardnet-local Scorecard observability defect. On exact PR #361 head c6d3fd45eba1aceef074cc8b9934937f67b1d41a, GitHub Advanced Security Scorecard check 103545605700 is neutral with 1 configuration not found for scorecard-analysis.yml / supply-chain/branch-protection. Root cause is the protected workflow's default-branch-only trigger set: main has the SARIF configuration, while PR heads normally have no matching Scorecard analysis for GitHub comparison. Upstream OpenSSF currently treats pull_request as experimental and does not support fork repos, so do not blindly add a privileged PR trigger or remove SARIF to silence the warning. #174 remains the sole workflow writer; use #362's RED/GREEN acceptance here or in a verified complete successor. No competing workflow branch created.