Repository navigation
Scorecard: Pinned-Dependencies (7/10) #726
Description
OpenSSF Scorecard Finding
Check: Pinned-Dependencies
Score: 7 / 10
Finding: dependency not pinned by hash detected -- score normalized to 7
Remediation
Context
This issue was automatically created from an OpenSSF Scorecard scan on 2026-07-14.
Activity
don-petry commentedon Jul 20, 2026
Weekly update: Score is now 9/10. Finding: dependency not pinned by hash detected -- score normalized to 9
don-petry commentedon Jul 27, 2026
Weekly update: Score is now 9/10. Finding: dependency not pinned by hash detected -- score normalized to 9
don-petry commentedon Aug 3, 2026
Weekly update: Score is now 9/10. Finding: dependency not pinned by hash detected -- score normalized to 9
don-petry commentedon Aug 10, 2026
Weekly update: Score is now 9/10. Finding: dependency not pinned by hash detected -- score normalized to 9
don-petry commentedon Aug 17, 2026
Weekly update: Score is now 9/10. Finding: dependency not pinned by hash detected -- score normalized to 9
don-petry commentedon Aug 24, 2026
Weekly update: Score is now 9/10. Finding: dependency not pinned by hash detected -- score normalized to 9
don-petry commentedon Aug 31, 2026
Weekly update: Score is now 9/10. Finding: dependency not pinned by hash detected -- score normalized to 9
don-petry commentedon Sep 7, 2026
Weekly update: Score is now 9/10. Finding: dependency not pinned by hash detected -- score normalized to 9
don-petry commentedon Sep 14, 2026
Weekly update: Score is now 9/10. Finding: dependency not pinned by hash detected -- score normalized to 9
don-petry commentedon Sep 21, 2026
Weekly update: Score is now 9/10. Finding: dependency not pinned by hash detected -- score normalized to 9
don-petry commentedon Sep 28, 2026
Weekly update: Score is now 9/10. Finding: dependency not pinned by hash detected -- score normalized to 9
don-petry commentedon Oct 5, 2026
Weekly update: Score is now 9/10. Finding: dependency not pinned by hash detected -- score normalized to 9
don-petry commentedon Oct 12, 2026
Weekly update: Score is now 9/10. Finding: dependency not pinned by hash detected -- score normalized to 9
don-petry commentedon Oct 19, 2026
Weekly update: Score is now 9/10. Finding: dependency not pinned by hash detected -- score normalized to 9
don-petry commentedon Oct 20, 2026
Auto-closing (accepted exception, #709): this Pinned-Dependencies finding is limited to GitHub Actions refs. Third-party action pinning is enforced by
compliance-audit.sh(which exempts first-party), and our first-party reusable refs deliberately use mutable channel tags perci-standards.md#action-pinning-policy. No action needed.