Skip to content

Commit 688f73f

Browse files
tym83tym83
committed
ci: pin Scorecard workflow actions by SHA
The initial Scorecard workflow used floating major-version tags (@v2, @v4, @V3). ossf/scorecard-action does not publish a floating v2 tag — only specific patch releases — so the first scheduled run failed with `Unable to resolve action ossf/scorecard-action@v2`. Pin every action by its full commit SHA with a trailing comment showing the human-readable version. This also satisfies the `Pinned-Dependencies` Scorecard check itself. - actions/checkout@de0fac2 (v6.0.2) - ossf/scorecard-action@4eaacf0 (v2.4.3) - actions/upload-artifact@043fb46 (v7.0.1) - github/codeql-action@03e4368 (v3) Signed-off-by: Timur Tukaev <[email protected]>
1 parent 3a8d1c5 commit 688f73f

1 file changed

Lines changed: 4 additions & 4 deletions

File tree

‎.github/workflows/scorecard.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,12 @@ jobs:
2929

3030
steps:
3131
- name: Checkout repository
32-
uses: actions/checkout@v4
32+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3333
with:
3434
persist-credentials: false
3535

3636
- name: Run analysis
37-
uses: ossf/scorecard-action@v2
37+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
3838
with:
3939
results_file: results.sarif
4040
results_format: sarif
@@ -43,13 +43,13 @@ jobs:
4343
publish_results: true
4444

4545
- name: Upload SARIF as artifact
46-
uses: actions/upload-artifact@v4
46+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
4747
with:
4848
name: scorecard-sarif
4949
path: results.sarif
5050
retention-days: 5
5151

5252
- name: Upload SARIF to code-scanning
53-
uses: github/codeql-action/upload-sarif@v3
53+
uses: github/codeql-action/upload-sarif@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3
5454
with:
5555
sarif_file: results.sarif

0 commit comments

Comments
 (0)