Finding
.github/workflows/boj-build.yml:18 has three coexisting bugs masked by `continue-on-error: true`:
1. Malformed curl JSON
```yaml
-d "{"repo": "${{ github.repository }}", "branch": "${{ github.ref_name }}", "engine": "casket\"}"}
```
After shell expansion: `{"repo": "...", "branch": "...", "engine": "casket}` followed by extra `"}` outside the shell string. Detected by OSSF Scorecard as "reached EOF without closing quote". Intended JSON appears to be `{"repo": "...", "branch": "...", "engine": "casket"}`.
2. Unreachable host
`http://boj-server.local:7700/cartridges/ssg-mcp/invoke\` uses `.local` (mDNS), which is NOT routable from GitHub-hosted runners. Step has never successfully reached the server.
3. `http://` violates secure-protocols estate policy
Memory hook `feedback_always_use_secure_protocols_in_docs` mandates `https://` / `wss://` etc.; Semgrep scans prose.
Two options
A. Delete the workflow if BoJ trigger is unused or has moved elsewhere.
B. Repair the JSON, switch to a routable `https://` endpoint, and either run on a self-hosted runner with mDNS visibility OR resolve `boj-server` to a public DNS name. Drop `continue-on-error: true` so failures actually fail.
Discovered: 2026-06-01 CI/CD audit.
Finding
.github/workflows/boj-build.yml:18has three coexisting bugs masked by `continue-on-error: true`:1. Malformed curl JSON
```yaml
-d "{"repo": "${{ github.repository }}", "branch": "${{ github.ref_name }}", "engine": "casket\"}"}
```
After shell expansion: `{"repo": "...", "branch": "...", "engine": "casket}` followed by extra `"}` outside the shell string. Detected by OSSF Scorecard as "reached EOF without closing quote". Intended JSON appears to be `{"repo": "...", "branch": "...", "engine": "casket"}`.
2. Unreachable host
`http://boj-server.local:7700/cartridges/ssg-mcp/invoke\` uses `.local` (mDNS), which is NOT routable from GitHub-hosted runners. Step has never successfully reached the server.
3. `http://` violates secure-protocols estate policy
Memory hook `feedback_always_use_secure_protocols_in_docs` mandates `https://` / `wss://` etc.; Semgrep scans prose.
Two options
A. Delete the workflow if BoJ trigger is unused or has moved elsewhere.
B. Repair the JSON, switch to a routable `https://` endpoint, and either run on a self-hosted runner with mDNS visibility OR resolve `boj-server` to a public DNS name. Drop `continue-on-error: true` so failures actually fail.
Discovered: 2026-06-01 CI/CD audit.