Scorecards supply-chain security/Scorecards analysis workflow failing on main branch

[aramase]

Error details: instance.runs[2].tool.driver.rules contains duplicate item
Error: Unable to upload "results.sarif" as it is not valid SARIF:
- instance.runs[2].tool.driver.rules contains duplicate item
Error: Unable to upload "results.sarif" as it is not valid SARIF:
- instance.runs[2].tool.driver.rules contains duplicate item
    at validateSarifFileSchema (/home/runner/work/_actions/github/codeql-action/a669cc5936cc5e1b6a362ec1ff9e410dc570d190/lib/upload-lib.js:189:15)
    at uploadFiles (/home/runner/work/_actions/github/codeql-action/a669cc5936cc5e1b6a362ec1ff9e410dc570d190/lib/upload-lib.js:238:9)
    at Object.uploadFromActions (/home/runner/work/_actions/github/codeql-action/a669cc5936cc5e1b6a362ec1ff9e410dc570d190/lib/upload-lib.js:132:18)
    at async run (/home/runner/work/_actions/github/codeql-action/a669cc5936cc5e1b6a362ec1ff9e410dc570d190/lib/upload-sarif-action.js:46:30)
    at async runWrapper (/home/runner/work/_actions/github/codeql-action/a669cc5936cc5e1b6a362ec1ff9e410dc570d190/lib/upload-sarif-action.js:68:9)

ref: https://github.com/deislabs/ratify/actions/runs/3681413597/jobs/6228071212

[akashsinghal]

Opened an issue on OSSF/scorecard-action repo for help: ossf/scorecard-action#1076

[akashsinghal]

Update: This issue cannot be replicated on any other branch for the repository. ossf maintainer cannot help further debug if it's not reproducible. They would require us to alter our main branch directly to collect more diagnostic logs and I don't know if we want to take such a drastic step.

[akashsinghal]

Update: issue in the main scorecard logic has been identified. Tracking issue upstream: ossf/scorecard#2686