ci: drop redundant CodeQL scan, fix Scorecard ARM64 incompatibility (#1399)

* ci: drop redundant CodeQL scan, fix Scorecard ARM64 incompatibility

codeql-action doesn't support Linux ARM64 (upstream: github/codeql-action#4072,
#2700), and every codeql "actions" rule already maps to a zizmor audit running
on ARM64 in ci.yml, so drop codeql.yml and raise zizmor's min-severity from
high to medium to keep equivalent coverage.

scorecard-action's amd64-only image has failed every scheduled run on
ubuntu-24.04-arm since at least 2026-07-20 (ossf/scorecard-action#1697).
Replace it with the checksum-verified linux_arm64 scorecard CLI binary,
matching the existing cargo-semver-checks pattern, and upload SARIF via
codeql-action/upload-sarif.

Closes #1398

Signed-off-by: Hugues Clouâtre <hugues@linux.com>

* ci: fix zizmor medium-severity findings surfaced by min-severity change

Raising zizmor's min-severity to medium (this PR) surfaces two pre-existing
findings unrelated to codeql/scorecard:

- dtolnay/rust-toolchain is pinned to the "stable" branch tip but commented
  "# 1.97.1", which zizmor reads as a mismatched version comment since a
  branch literally named "1.97.1" points elsewhere. The actual desired
  version is already set via the "toolchain" input; correct the comment to
  "# stable" to match what's really pinned (matches the existing correct
  usage in update-deps.yml).
- release.yml and release-repair.yml pass `secrets: inherit` into
  build-and-attest.yml, which only ever reads the auto-provided
  GITHUB_TOKEN. Drop the unneeded blanket secret grant.

Signed-off-by: Hugues Clouâtre <hugues@linux.com>

---------

Signed-off-by: Hugues Clouâtre <hugues@linux.com>

Author: clouatre

.github/workflows/build-and-attest.yml

@@ -49,7 +49,7 @@ jobs:
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # 1.97.1
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: "1.97.1"
           targets: ${{ inputs.target }}

.github/workflows/ci.yml

@@ -122,7 +122,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # 1.97.1
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: "1.97.1"
           components: rustfmt, clippy
@@ -159,7 +159,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # 1.97.1
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: "1.97.1"
           components: llvm-tools-preview
@@ -232,7 +232,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # 1.97.1
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: "1.97.1"
       - name: Setup Rust cache
@@ -257,7 +257,7 @@ jobs:
         with:
           advanced-security: false
           annotations: true
-          min-severity: high
+          min-severity: medium
 
   semver-checks:
     name: semver checks

.github/workflows/codeql.yml

@@ -61,7 +61,6 @@ jobs:
       cross: false
       version: ${{ inputs.version }}
       dry_run: ${{ inputs.dry_run }}
-    secrets: inherit
 
   build-aarch64-unknown-linux-musl:
     name: Build aarch64-unknown-linux-musl
@@ -77,7 +76,6 @@ jobs:
       cross: true
       version: ${{ inputs.version }}
       dry_run: ${{ inputs.dry_run }}
-    secrets: inherit
 
   build-x86_64-unknown-linux-musl:
     name: Build x86_64-unknown-linux-musl
@@ -93,7 +91,6 @@ jobs:
       cross: true
       version: ${{ inputs.version }}
       dry_run: ${{ inputs.dry_run }}
-    secrets: inherit
 
   update-homebrew:
     name: Update Homebrew Formula

.github/workflows/release-repair.yml

@@ -151,7 +151,6 @@ jobs:
       cross: ${{ matrix.cross }}
       version: ${{ needs.create-release.outputs.version }}
       dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run == true }}
-    secrets: inherit
 
   update-homebrew:
     name: Update Homebrew Formula
@@ -443,7 +442,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install Rust stable
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # 1.97.1
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: "1.97.1"
 

.github/workflows/release.yml

@@ -15,16 +15,29 @@ jobs:
     permissions:
       contents: read
       security-events: write
-      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
+      - name: Install Scorecard CLI
+        env:
+          VERSION: "5.5.0"
+          SHA256: "3ce59d20c1d53e540c4a14e0da1e0d96b3b294e8ddc96a3c5a7b8a637b32991e"
+        run: |
+          curl -fsSL "https://github.com/ossf/scorecard/releases/download/v${VERSION}/scorecard_${VERSION}_linux_arm64.tar.gz" \
+            -o scorecard.tar.gz
+          echo "${SHA256}  scorecard.tar.gz" | sha256sum -c -
+          tar -xzf scorecard.tar.gz
+
       - name: Run OpenSSF Scorecard
-        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        env:
+          ENABLE_SARIF: "1"
+          GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./scorecard --repo=github.com/clouatre-labs/aptu-coder --format=sarif --show-details > results.sarif
+
+      - name: Upload SARIF results
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
+          sarif_file: results.sarif