From 48b28d9570aca3f595e08da3395d6e0bfbe682f2 Mon Sep 17 00:00:00 2001
From: FolderView Plus Test <folderviewplus@example.com>
Date: Sun, 30 Aug 2026 10:07:53 -0400
Subject: [PATCH] Refresh OpenSSF Scorecard findings

---
 .github/workflows/scorecard.yml          |  3 +++
 docs/codeql-triage.md                    |  5 +++--
 scripts/workflow_self_check.sh           |  1 +
 tests/helpers/fast-check.js              |  5 +++++
 tests/security-property-fuzz.test.mjs    |  2 +-
 tests/security-release-contract.test.mjs | 11 ++++++++++-
 6 files changed, 23 insertions(+), 4 deletions(-)
 create mode 100644 tests/helpers/fast-check.js

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 15a358bc..76ebf5f5 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -2,6 +2,9 @@ name: OpenSSF Scorecard
 
 on:
   branch_protection_rule:
+  push:
+    branches:
+      - main
   schedule:
     - cron: '29 7 * * 2'
   workflow_dispatch:
diff --git a/docs/codeql-triage.md b/docs/codeql-triage.md
index d3c62fd7..3a2c2430 100644
--- a/docs/codeql-triage.md
+++ b/docs/codeql-triage.md
@@ -28,8 +28,9 @@ CodeQL Action v4 runs for pushes and pull requests targeting both `dev` and
 no new high-or-higher security findings before a protected branch can be merged.
 Dependency Review separately rejects pull requests that introduce high-or-critical
 known vulnerabilities or licenses outside the repository's approved quality-tooling
-set. OpenSSF Scorecard publishes a scheduled supply-chain posture report to code
-scanning. The weekly OSV job scans the generated CycloneDX dependency inventory,
+set. OpenSSF Scorecard publishes a supply-chain posture report to code scanning
+on every `main` push and on its weekly schedule. The weekly OSV job scans the
+generated CycloneDX dependency inventory,
 uploads SARIF, and fails when it reports a known vulnerability. A scheduled-workflow
 watchdog checks that CodeQL, Scorecard, and OSV continue producing timely successful
 runs and maintains one recovery issue if they do not. Code-quality findings remain
diff --git a/scripts/workflow_self_check.sh b/scripts/workflow_self_check.sh
index c0334400..24024eed 100644
--- a/scripts/workflow_self_check.sh
+++ b/scripts/workflow_self_check.sh
@@ -209,6 +209,7 @@ if (!/actions\/dependency-review-action@[0-9a-f]{40}\s+# v5/.test(dependencyRevi
 }
 if (!/ossf\/scorecard-action@[0-9a-f]{40}\s+# v2\.4\.4/.test(scorecardWorkflow)
     || !/github\/codeql-action\/upload-sarif@[0-9a-f]{40}\s+# v4/.test(scorecardWorkflow)
+    || !/push:\s*\n\s*branches:\s*\n\s*- main/.test(scorecardWorkflow)
     || !/publish_results:\s*true/.test(scorecardWorkflow)
     || !/security-events:\s*write/.test(scorecardWorkflow)
     || !/id-token:\s*write/.test(scorecardWorkflow)) {
diff --git a/tests/helpers/fast-check.js b/tests/helpers/fast-check.js
new file mode 100644
index 00000000..e5efc055
--- /dev/null
+++ b/tests/helpers/fast-check.js
@@ -0,0 +1,5 @@
+'use strict';
+
+// Keep the property-test dependency in a .js module so OpenSSF Scorecard can
+// recognize the same fast-check harness that the Node test suite executes.
+module.exports = require('fast-check');
diff --git a/tests/security-property-fuzz.test.mjs b/tests/security-property-fuzz.test.mjs
index 2cf6e131..b4361f29 100644
--- a/tests/security-property-fuzz.test.mjs
+++ b/tests/security-property-fuzz.test.mjs
@@ -1,7 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
-import fc from 'fast-check';
+import fc from './helpers/fast-check.js';
 import {
     compareSanitizedSupportBundles,
     renderSupportBundleComparisonMarkdown
diff --git a/tests/security-release-contract.test.mjs b/tests/security-release-contract.test.mjs
index ab880ccc..71d798a5 100644
--- a/tests/security-release-contract.test.mjs
+++ b/tests/security-release-contract.test.mjs
@@ -74,8 +74,9 @@ test('dependency review blocks vulnerable or unapproved dependency changes', ()
     assert.match(workflow, /warn-only: false/);
 });
 
-test('OpenSSF Scorecard publishes pinned SARIF results on a schedule', () => {
+test('OpenSSF Scorecard refreshes main findings and publishes pinned SARIF results', () => {
     const workflow = read('.github/workflows/scorecard.yml');
+    assert.match(workflow, /push:\s*\n\s*branches:\s*\n\s*- main/);
     assert.match(workflow, /schedule:/);
     assert.match(workflow, /workflow_dispatch:/);
     assert.match(workflow, /ossf\/scorecard-action@[0-9a-f]{40}\s+# v2\.4\.4/);
@@ -85,6 +86,14 @@ test('OpenSSF Scorecard publishes pinned SARIF results on a schedule', () => {
     assert.match(workflow, /id-token: write/);
 });
 
+test('OpenSSF Scorecard can detect the fast-check property-test harness', () => {
+    const adapter = read('tests/helpers/fast-check.js');
+    const suite = read('tests/security-property-fuzz.test.mjs');
+    assert.match(adapter, /require\(['"]fast-check['"]\)/);
+    assert.match(suite, /from ['"]\.\/helpers\/fast-check\.js['"]/);
+    assert.match(suite, /fc\.assert\(fc\.property\(/);
+});
+
 test('workflows never upload live Unraid browser evidence', () => {
     for (const workflow of workflows) {
         const uploadBlocks = workflow.source.split(/\n(?=\s{6}- name:|\s{4}- name:)/)