ci(scorecard): skip on private repos (GHAS not available)

Author: marcohost33-maker

.github/workflows/scorecard.yml

@@ -1,5 +1,10 @@
 # OpenSSF Scorecard — supply-chain security health metrics
 # Docs: https://github.com/ossf/scorecard-action
+#
+# Note: Scorecard requires read access to the GitHub GraphQL API. On private
+# repos without GitHub Advanced Security this fails with "Resource not
+# accessible by integration". We skip the job on private repos until the
+# repo is made public or GHAS is enabled.
 name: OpenSSF Scorecard
 
 on:
@@ -15,10 +20,12 @@ permissions: read-all
 jobs:
   analysis:
     name: Scorecard analysis
+    # Scorecard cannot run on private repos without GHAS — skip to keep CI green.
+    if: github.event.repository.private == false
     runs-on: ubuntu-latest
     permissions:
-      security-events: write   # upload SARIF to Code Scanning (no-op on private repos without GHAS)
-      id-token: write          # publish to OSSF registry (optional)
+      security-events: write
+      id-token: write
       contents: read
       actions: read
 
@@ -33,7 +40,7 @@ jobs:
         with:
           results_file: results.sarif
           results_format: sarif
-          publish_results: false   # private repo — keep results internal
+          publish_results: false
 
       - name: Upload artifact
         if: ${{ !cancelled() && hashFiles('results.sarif') != '' }}
@@ -44,8 +51,6 @@ jobs:
           retention-days: 30
 
       - name: Upload to code-scanning
-        # Code-scanning upload requires GHAS on private repos. Skip when
-        # no SARIF was produced and tolerate the GHAS-not-available case.
         if: ${{ !cancelled() && hashFiles('results.sarif') != '' }}
         continue-on-error: true
         uses: github/codeql-action/upload-sarif@f411752efdf656cb71aa17b755b22c890960da1d  # v3.35.5