ci: keep Node24 forcing without tripping scorecard checks

.github/workflows/codeql.yml

@@ -1,8 +1,5 @@
 name: codeql
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 on:
   push:
     branches: [main, develop]
@@ -19,6 +16,8 @@ jobs:
   analyze:
     name: codeql (python)
     runs-on: ubuntu-latest
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

.github/workflows/dependency-review.yml

@@ -1,8 +1,5 @@
 name: dependency-review
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 on:
   pull_request:
 
@@ -14,6 +11,8 @@ jobs:
   dependency-review:
     name: dependency-review
     runs-on: ubuntu-latest
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

.github/workflows/gh-pages.yml

@@ -1,8 +1,5 @@
 name: Deploy Web Manual to GitHub Pages
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 on:
   push:
     branches:
@@ -27,6 +24,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
       - name: Checkout repository
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
@@ -62,6 +61,8 @@ jobs:
     permissions:
       pages: write
       id-token: write
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

.github/workflows/quality-gate.yml

@@ -1,8 +1,5 @@
 name: quality-gate
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 on:
   push:
     branches: [main, develop]
@@ -15,6 +12,8 @@ jobs:
   quality-gate:
     name: quality-gate
     runs-on: ubuntu-latest
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

.github/workflows/release.yml

@@ -1,8 +1,5 @@
 name: release
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 on:
   push:
     tags:
@@ -18,6 +15,8 @@ jobs:
   release:
     name: release
     runs-on: ubuntu-latest
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

.github/workflows/scorecards.yml

@@ -1,8 +1,5 @@
 name: scorecards
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 on:
   push:
     branches: [develop]
@@ -21,6 +18,8 @@ jobs:
       id-token: write
       contents: read
       actions: read
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

.github/workflows/tests.yml

@@ -1,8 +1,5 @@
 name: tests
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 on:
   push:
     branches: [main, develop]
@@ -14,6 +11,8 @@ permissions:
 jobs:
   pytest:
     runs-on: ubuntu-latest
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

tests/test_workflow_runtime_env.py

@@ -1,10 +1,26 @@
 from pathlib import Path
 
+import yaml
 
-def test_javascript_actions_are_forced_to_node24():
-    workflow_paths = sorted(Path(".github/workflows").glob("*.yml")) + sorted(
+
+def _workflow_paths() -> list[Path]:
+    return sorted(Path(".github/workflows").glob("*.yml")) + sorted(
         Path(".github/workflows").glob("*.yaml")
     )
-    for workflow_path in workflow_paths:
+
+
+def test_each_workflow_job_forces_javascript_actions_to_node24():
+    for workflow_path in _workflow_paths():
+        data = yaml.safe_load(workflow_path.read_text(encoding="utf-8"))
+        for job_name, job_data in data["jobs"].items():
+            assert job_data["env"]["FORCE_JAVASCRIPT_ACTIONS_TO_NODE24"] is True, (
+                workflow_path,
+                job_name,
+            )
+
+
+def test_workflows_do_not_use_top_level_env_blocks():
+    for workflow_path in _workflow_paths():
         text = workflow_path.read_text(encoding="utf-8")
-        assert "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true" in text, workflow_path
+        assert not text.startswith("env:\n")
+        assert "\nenv:\n" not in text.split("jobs:", 1)[0], workflow_path