From 95d3d8a6c1da75ab6ed7fb6bfe282a27827102d1 Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Thu, 9 Jul 2026 09:53:57 +0100
Subject: [PATCH 1/3] Fix scorecard artifact upload action

---
 .github/workflows/scorecard.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 92b6872b..6fa5c762 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -59,9 +59,9 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
+        uses: actions/upload-artifact@v7
         with:
-          name: SARIF file
+          name: sarif-file
           path: results.sarif
           retention-days: 5
 

From 98d5bac4e8e8f41347221377563f7dd9ff1fbc54 Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Thu, 9 Jul 2026 11:38:26 +0100
Subject: [PATCH 2/3] fix(quiz-app): restore package.json and package-lock.json
 for Node 24

---
 etc/quiz-app/package-lock.json | 15 +++++++++------
 etc/quiz-app/package.json      |  3 +++
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/etc/quiz-app/package-lock.json b/etc/quiz-app/package-lock.json
index 3d130f92..0f4a6709 100644
--- a/etc/quiz-app/package-lock.json
+++ b/etc/quiz-app/package-lock.json
@@ -21,6 +21,9 @@
         "eslint": "^9.33.0",
         "eslint-plugin-vue": "^10.4.0",
         "vue-template-compiler": "^2.6.11"
+      },
+      "overrides": {
+        "picomatch": "2.3.2"
       }
     },
     "node_modules/@achrinza/node-ipc": {
@@ -8483,9 +8486,9 @@
       "dev": true
     },
     "node_modules/picomatch": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true,
       "engines": {
         "node": ">=8.6"
@@ -17845,9 +17848,9 @@
       "dev": true
     },
     "picomatch": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true
     },
     "pkg-dir": {
diff --git a/etc/quiz-app/package.json b/etc/quiz-app/package.json
index 5ba3bd54..04a6c991 100644
--- a/etc/quiz-app/package.json
+++ b/etc/quiz-app/package.json
@@ -22,6 +22,9 @@
     "eslint-plugin-vue": "^10.4.0",
     "vue-template-compiler": "^2.6.11"
   },
+  "overrides": {
+    "picomatch": "2.3.2"
+  },
   "eslintConfig": {
     "root": true,
     "env": {

From 1cc4c372e35157524f9b32c0f6a6a921af28731d Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Thu, 9 Jul 2026 11:43:08 +0100
Subject: [PATCH 3/3] ci(scorecard): use safe artifact name and add SARIF
 pre-upload debug

---
 .github/workflows/scorecard.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 6fa5c762..f29d380e 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -58,10 +58,18 @@ jobs:
 
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
+      - name: "Show SARIF file"
+        run: |
+          echo "SARIF file listing:"
+          ls -la results.sarif || true
+          echo "SARIF file type (if available):"
+          file results.sarif || true
+
       - name: "Upload artifact"
         uses: actions/upload-artifact@v7
         with:
-          name: sarif-file
+          # Use a simple, lowercase artifact name without spaces to avoid API validation
+          name: results-sarif
           path: results.sarif
           retention-days: 5