🐛 Fixing parsing for Github workflow when matrix is an expression

[ristomcgehee]

• Please check if the PR fulfills these requirements

• Tests for the changes have been added (for bug fixes / features)
• PR title follows the guidelines defined in https://github.com/ossf/scorecard/blob/main/CONTRIBUTING.md#pr-process

• What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)
  Bug fix

• What is the current behavior? (You can also link to an open issue here)
  Running ./scorecard --repo=ljharb/array-includes --show-details --checks=Pinned-Dependencies errors out when parsing one of the gh workflow files. This is because matrix does not have an os key:

  stable:
    needs: [matrix]
    name: 'stable minors'
    runs-on: ubuntu-latest

    strategy:
      matrix: ${{ fromJson(needs.matrix.outputs.stable) }}

Part of #839

• Does this PR introduce a breaking change? (What changes might users need to make in their application due to this PR?)
  No

[ristomcgehee]

I removed the - because I noticed in lucas-clemente/quic-go that you can use expressions to construct the OS name. 🤮

[laurentsimon]

Thanks Chris!

[laurentsimon]

1. does this work if there's a single os defined, i.e., len(job.RunsOn) == 1? Seems like the following code assumes data is in the job.Strategy.Matrix if this if-statement is false.
2. is there a chance that job.RunsOn has length 0 and !strings.Contains(job.RunsOn[0], "matrix.os") evaluation will crash?

[ristomcgehee]

I tweaked this code to make it more readable. With my changes I think it'll be easier to see the code will work when len(job.RunsOn) is 1 or 0.

accidental approval

[laurentsimon]

I would have thought this test would return an error since we don't try to parse things like fromJson(needs.matrix.outputs.latest) and return error unable to determine OS for job.

[ristomcgehee]

In github-workflow-matrix-expression.yaml and in ljharb/array-includes, the runs-on field contains the OS so we are able to avoid returning an error.