From 6e86d8f1efaa0e72b0d03602c043967156a29fbf Mon Sep 17 00:00:00 2001
From: Imran Siddique <imran.siddique@opaque.co>
Date: Thu, 11 Jun 2026 16:40:58 -0700
Subject: [PATCH] fix(ci): declare cedarpy dependency; repair Scorecard
 workflow

- cedarpy was never a declared dependency: locally it is present so all
  tests pass, but CI runners lack it, CedarBackend auto mode fails closed,
  and the benchmark tests deny every call (main CI red since 2026-06-10).
  The runtime is not functional without a real Cedar engine.
- ossf/scorecard-action@v2 is not a resolvable ref; pinned to the v2.4.3
  commit SHA. publish_results disabled while the repo is private (dated
  note to flip after launch); permissions aligned with the official
  scorecard template (top-level read-all, job-level writes).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/scorecard.yml | 17 ++++++++++-------
 pyproject.toml                  |  1 +
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b36047c..e77291d 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -8,15 +8,16 @@ on:
     branches:
       - main
 
-permissions:
-  security-events: write
-  id-token: write
-  contents: read
-  actions: read
+permissions: read-all
 
 jobs:
   scorecard:
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -25,11 +26,13 @@ jobs:
           fetch-depth: 0
 
       - name: Run Scorecard
-        uses: ossf/scorecard-action@v2
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
         with:
           results_file: scorecard-results.sarif
           results_format: sarif
-          publish_results: true
+          # publish_results requires a public repo; flip to true after the
+          # 2026-06-23 public launch.
+          publish_results: false
 
       - name: Upload SARIF
         uses: github/codeql-action/upload-sarif@v4
diff --git a/pyproject.toml b/pyproject.toml
index 944ac8b..8347cff 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -35,6 +35,7 @@ dependencies = [
     "uvicorn>=0.29",
     "click>=8.1",
     "agent-governance-toolkit-core>=4.0",
+    "cedarpy>=4.0",
 ]
 
 [project.optional-dependencies]