Thesis: That action wants a license secret on an organization account. A personal account does not. A red run that means "no license" is not evidence of a secret scan. The required check is the open-source CLI on the application tree. The action stays in the file and runs only when the license secret is set.
What we tried first
The excerpt is three lines. We copied the action tag into the required job so the sample would match what a visitor sees on the homepage. The organization account has no license secret. The job failed closed on the license, not on a leaked key. An assessor who opened that run would see a setup failure and no scan of the tree.
The working shape
The required step installs the CLI and scans the application tree. No license. The action tag stays in the file, and the step is skipped unless the license secret is present. If you use the action, pin the commit SHA, not the moving tag.
organization + action tag, no license → fail before scan
required job → CLI on the app tree
action tag → only when the license secret is setChecklist
- Do not make the action tag the required check on an organization account unless the license secret is present.
- Pin the commit SHA if you use the action. Do not pin only the moving tag.
- The CLI scan is the required check. It does not need a third-party license.
Related: the example key does not fail the scan. The workflow is in the public sample. How we deliver: methodology.
Engineering commentary only — not audit, legal, or certification advice.