ci: Unbreak the scorecard workflow

* Fix syntax error, other minor touch-ups
* Don't run other workflows when only scorecard.yml changes

Signed-off-by: Larry Gritz <lg@larrygritz.com>

.github/workflows/analysis.yml

@@ -23,6 +23,7 @@ on:
       - '!**.rst'
       - '!**/ci.yml'
       - '!**/docs.yml'
+      - '!**/scorecard.yml'
       - '!**.properties'
       - '!docs/**'
   # Run analysis on PRs only if the branch name indicates that the purpose of

.github/workflows/ci.yml

@@ -13,6 +13,7 @@ on:
       - '!**.rst'
       - '!**/analysis.yml'
       - '!**/docs.yml'
+      - '!**/scorecard.yml'
       - '!**.properties'
       - '!docs/**'
   pull_request:

.github/workflows/scorecard.yml

@@ -8,19 +8,12 @@ on:
   # Only the default branch is supported.
   branch_protection_rule:
   push:
-    # Run on pushes to main, but only the main repo, not forks
-    branches: [ "main" ]
+    # Run on pushes to main, but only the official repo, not forks
     if: github.event.pull_request.head.repo.full_name == github.repository
-    paths-ignore:
-      - '**.md'
-      - '**.rst'
-      - 'docs/**'
   pull_request:
-    # Only run on individual PRs if the workflow file itself is changed.
-    paths-ignore:
-      - '**.md'
-      - '**.rst'
-      - 'docs/**'
+    # Only run on individual PRs if the workflows changed
+    paths:
+      - '.github/workflows/**'
 
 # Declare default permissions as read only.
 permissions: read-all
@@ -47,7 +40,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
           fetch-depth: '0'