Repository navigation
Scorecard: Pinned-Dependencies (4/10) #1240
Description
OpenSSF Scorecard Finding
Check: Pinned-Dependencies
Score: 3 / 10
Finding: dependency not pinned by hash detected -- score normalized to 3
Remediation
Context
This issue was automatically created from an OpenSSF Scorecard scan on 2026-07-14.
Activity
github-actions commentedon Jul 14, 2026
Thanks for the automated Scorecard report — pinning Actions dependencies to full commit SHAs is an important supply-chain hardening measure that prevents a compromised tag or branch from silently swapping in malicious code. Could you share (or run
scorecard --checks PinnedDependencies --format jsonand paste the output) which specific workflow files and action references were flagged as unpinned, so we can prioritize the remediation order?don-petry commentedon Jul 20, 2026
Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3
don-petry commentedon Jul 27, 2026
Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3
don-petry commentedon Aug 3, 2026
Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3
don-petry commentedon Aug 10, 2026
Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3
don-petry commentedon Aug 17, 2026
Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3
don-petry commentedon Aug 24, 2026
Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3
don-petry commentedon Aug 31, 2026
Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3
don-petry commentedon Sep 7, 2026
Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3
don-petry commentedon Sep 14, 2026
Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3
don-petry commentedon Sep 21, 2026
Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3
don-petry commentedon Sep 28, 2026
Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3
don-petry commentedon Oct 5, 2026
Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3
don-petry commentedon Oct 12, 2026
Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3
don-petry commentedon Oct 19, 2026
Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3
don-petry commentedon Oct 20, 2026
Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3
[-]Scorecard: Pinned-Dependencies (3/10)[/-][+]Scorecard: Pinned-Dependencies (4/10)[/+]don-petry commentedon Oct 26, 2026
Weekly update: Score is now 4/10. Finding: dependency not pinned by hash detected -- score normalized to 4