From 38024d966b1df89c7e0340b9eaeccabd10378d9f Mon Sep 17 00:00:00 2001
From: Javier Rodriguez <javier@chainloop.dev>
Date: Mon, 5 Oct 2026 13:50:10 +0200
Subject: [PATCH] ci: remove the daily SCM configuration check workflow

The SCM configuration check for this repository moves to the managed
check that the Chainloop platform runs. The platform uses its own GitHub
App installation token, which can read branch protection and repository
security settings.

The GitHub Actions job used a token with only contents and metadata read
permissions. With that token the gatherer cannot read branch protection,
so the check reported that main has no protection rules.

Assisted-by: Claude Code
Signed-off-by: Javier Rodriguez <javier@chainloop.dev>
---
 .../workflows/scm_configuration_check.yaml    | 66 -------------------
 1 file changed, 66 deletions(-)
 delete mode 100644 .github/workflows/scm_configuration_check.yaml

diff --git a/.github/workflows/scm_configuration_check.yaml b/.github/workflows/scm_configuration_check.yaml
deleted file mode 100644
index 5abcf8a68..000000000
--- a/.github/workflows/scm_configuration_check.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-name: Daily SCM Configuration Check
-
-on:
-  schedule:
-    # Run daily at 9:00 AM UTC
-    - cron: "0 9 * * *"
-  workflow_dispatch: # Allow manual triggering
-
-permissions: read-all
-
-jobs:
-  scm-configuration-check:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-
-    env:
-      CHAINLOOP_WORKFLOW_NAME: scm-configuration-check
-      CHAINLOOP_PROJECT_NAME: chainloop
-      GITHUB_TOKEN: ${{ github.token }}
-
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          persist-credentials: false
-
-      - name: Install Chainloop
-        run: |
-          curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s
-
-      - name: Initialize Attestation
-        run: |
-          chainloop attestation init --org chainloop --workflow ${CHAINLOOP_WORKFLOW_NAME} --project ${CHAINLOOP_PROJECT_NAME}
-
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          app-id: ${{ vars.CHAINLOOP_GATHERER_APP_ID }}
-          private-key: ${{ secrets.GATHERER_APP_PRIVATE_KEY }}
-          permission-contents: read
-          permission-metadata: read
-
-      - name: Gather runner context data
-        run: |
-          chainloop gather-runner-context --runner-token ${{ steps.generate-token.outputs.token }} --branches=main
-
-      - name: Add runner context material to attestation
-        run: |
-          chainloop attestation add --name runner-context --value ./runner-context.json --kind CHAINLOOP_RUNNER_CONTEXT
-
-      - name: Finish and Record Attestation
-        if: ${{ success() }}
-        run: |
-          chainloop attestation push --exception-bypass-policy-check
-
-      - name: Mark attestation as failed
-        if: ${{ failure() }}
-        run: |
-          chainloop attestation reset
-
-      - name: Mark attestation as cancelled
-        if: ${{ cancelled() }}
-        run: |
-          chainloop attestation reset --trigger cancellation