Skip to content

Scorecard: Pinned-Dependencies (6/10) #18

Closed
Closed
Scorecard: Pinned-Dependencies (6/10)#18
Labels
dev-leadFor dev-lead agent pickupscorecardOpenSSF Scorecard finding

Description

@don-petry
don-petry
opened on Mar 27, 2026

OpenSSF Scorecard Finding

Check: Pinned-Dependencies
Score: 6 / 10
Finding: dependency not pinned by hash detected

Remediation

https://github.com/ossf/scorecard/blob/80ee3ecfedf8b19ab8991713a9fdb2e7dcd7262e/docs/checks.md#pinned-dependencies

Context

This issue was automatically created from an OpenSSF Scorecard scan on 2026-03-27.

Activity

  1. don-petry
    added
    scorecardOpenSSF Scorecard finding
    on Mar 27, 2026
  2. don-petry
    added a commit that references this issue on Mar 27, 2026

    fix: address OpenSSF Scorecard findings

    687cea3
  3. don-petry
    added
    claude
    on Apr 5, 2026

  4. claude commented on Apr 5, 2026

    @claude
    claudeBot
    on Apr 5, 2026 – with Claude

    Claude Code is working…

    I'll analyze this and get back to you.

    View job run

  5. don-petry commented on May 17, 2026

    @don-petry
    don-petry
    on May 17, 2026
    ContributorAuthor

    Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3

  6. don-petry commented on May 17, 2026

    @don-petry
    don-petry
    on May 17, 2026
    ContributorAuthor

    Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3

  7. don-petry commented on May 17, 2026

    @don-petry
    don-petry
    on May 17, 2026
    ContributorAuthor

    Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3

  8. don-petry commented on May 17, 2026

    @don-petry
    don-petry
    on May 17, 2026
    ContributorAuthor

    Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3

  9. don-petry commented on May 18, 2026

    @don-petry
    don-petry
    on May 18, 2026
    ContributorAuthor

    Weekly update: Score is now 3/10. Finding: dependency not pinned by hash detected -- score normalized to 3

  10. don-petry commented on May 25, 2026

    @don-petry
    don-petry
    on May 25, 2026
    ContributorAuthor

    Weekly update: Score is now 7/10. Finding: dependency not pinned by hash detected -- score normalized to 7

  11. don-petry commented on Jun 1, 2026

    @don-petry
    don-petry
    on Jun 1, 2026
    ContributorAuthor

    Weekly update: Score is now 6/10. Finding: dependency not pinned by hash detected -- score normalized to 6

  12. don-petry
    added
    dev-leadFor dev-lead agent pickup
    and removed
    claude
    on Jun 6, 2026

  13. don-petry commented on Jun 6, 2026

    @don-petry
    don-petry
    on Jun 6, 2026
    ContributorAuthor

    Dev-Lead Implementation Plan

    Issue: #18 — Scorecard: Pinned-Dependencies (6/10)

    Scope

    Pin all GitHub Actions workflow references and Dockerfile base images to immutable SHA hashes so the OpenSSF Scorecard Pinned-Dependencies check passes.

    Root Cause

    Four thin-caller workflow stubs reference reusable workflows using mutable tags (@v2, @main) instead of commit SHAs. The API Dockerfile also uses floating image tags without SHA digests.

    Implementation Checklist

    • .github/workflows/dependency-audit.yml — pin petry-projects/.github/...@v2 → @376a4fcb1117444595e3e702fa450873d0e54310 # v2
    • .github/workflows/pr-auto-review.yml — pin petry-projects/.github/...@v2 → @376a4fcb1117444595e3e702fa450873d0e54310 # v2
    • .github/workflows/pr-review-mention.yml — pin petry-projects/.github/...@v2 → @376a4fcb1117444595e3e702fa450873d0e54310 # v2
    • .github/workflows/pr-review.yml — pin petry-projects/.github-private/...@main → @7b0426146444d97550dcca89d86984b809288506 # main
    • apps/api/Dockerfile — pin golang:1.24-alpine → golang:1.24-alpine@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191
    • apps/api/Dockerfile — pin gcr.io/distroless/static-debian12 → gcr.io/distroless/static-debian12@sha256:9c346e4be81b5ca7ff31a0d89eaeade58b0f95cfd3baed1f36083ddb47ca3160

    Tests to Write

    TDD exception: This is a pure configuration change (YAML workflow files and Dockerfile FROM pins) with no observable code behavior change. There is no meaningful failing test stub to write before implementation. Verification is via the dev-lead-lint.sh check plus manual inspection of the changed files.

    Test Command

    bash ".dev-lead/scripts/dev-lead-lint.sh"

  14. don-petry commented on Jun 6, 2026

    @don-petry
    don-petry
    on Jun 6, 2026
    ContributorAuthor

    Dev-Lead: Implementation Complete

    Plan Execution

    • .github/workflows/dependency-audit.yml — pinned @v2 → @376a4fcb1117444595e3e702fa450873d0e54310 # v2
    • .github/workflows/pr-auto-review.yml — pinned @v2 → @376a4fcb1117444595e3e702fa450873d0e54310 # v2
    • .github/workflows/pr-review-mention.yml — pinned @v2 → @376a4fcb1117444595e3e702fa450873d0e54310 # v2
    • .github/workflows/pr-review.yml — pinned @main → @7b0426146444d97550dcca89d86984b809288506 # main
    • apps/api/Dockerfile — pinned golang:1.24-alpine with SHA digest
    • apps/api/Dockerfile — pinned gcr.io/distroless/static-debian12 with SHA digest

    TDD Exception

    This is a pure configuration change (YAML workflow files and Dockerfile FROM pins) with no observable code behavior change. No behavioral tests can be written before implementation per the Phase 2 exception clause.

    Lint Results

      [lint] shellcheck on 2 file(s)...
  [lint] all checks passed

    go vet ./... — passed (no output)

    Files Changed

    • .github/workflows/dependency-audit.yml: Pinned reusable workflow ref from @v2 to SHA 376a4fcb...
    • .github/workflows/pr-auto-review.yml: Pinned reusable workflow ref from @v2 to SHA 376a4fcb...
    • .github/workflows/pr-review-mention.yml: Pinned reusable workflow ref from @v2 to SHA 376a4fcb...
    • .github/workflows/pr-review.yml: Pinned reusable workflow ref from @main to SHA 7b042614...
    • apps/api/Dockerfile: Pinned golang:1.24-alpine to @sha256:8bee1901... and gcr.io/distroless/static-debian12 to @sha256:9c346e4b...

    Notes

    • The SHA 376a4fcb1117444595e3e702fa450873d0e54310 for petry-projects/.github@v2 is consistent with the SHA already used in auto-rebase.yml, agent-shield.yml, dependabot-automerge.yml, and feature-ideation.yml.
    • The SHA 7b0426146444d97550dcca89d86984b809288506 for petry-projects/.github-private@main was resolved via gh api repos/petry-projects/.github-private/git/refs/heads/main.
    • Docker image digests were resolved via skopeo inspect against the live registries.
    • The dependabot.yml already has github-actions ecosystem configured (weekly, limit 10 PRs), which will keep action SHAs updated via Dependabot PRs. Docker ecosystem is not currently in dependabot.yml; adding it is a follow-up if desired to automate SHA refreshes for the Dockerfile base images.

  15. 7 remaining items

  16. don-petry
    added 3 commits that reference this issue on Jun 20, 2026

    feat: implement issue #18 — Scorecard: Pinned-Dependencies (6/10)

    85346e4

    fix: address OpenSSF Scorecard findings

    8fa7fb0

    feat: implement issue #18 — Scorecard: Pinned-Dependencies (6/10)

    46c4bda

  17. don-petry commented on Jun 22, 2026

    @don-petry
    don-petry
    on Jun 22, 2026
    ContributorAuthor

    Weekly update: Score is now 4/10. Finding: dependency not pinned by hash detected -- score normalized to 4

  18. don-petry commented on Jun 29, 2026

    @don-petry
    don-petry
    on Jun 29, 2026
    ContributorAuthor

    Weekly update: Score is now 4/10. Finding: dependency not pinned by hash detected -- score normalized to 4

  19. don-petry commented on Jul 6, 2026

    @don-petry
    don-petry
    on Jul 6, 2026
    ContributorAuthor

    Weekly update: Score is now 5/10. Finding: dependency not pinned by hash detected -- score normalized to 5

  20. don-petry commented on Jul 13, 2026

    @don-petry
    don-petry
    on Jul 13, 2026
    ContributorAuthor

    Weekly update: Score is now 5/10. Finding: dependency not pinned by hash detected -- score normalized to 5

  21. don-petry commented on Jul 14, 2026

    @don-petry
    don-petry
    on Jul 14, 2026
    ContributorAuthor

    Closing as accepted exception. First-party reusable-workflow refs intentionally use mutable channel tags (<agent>/v<M>-<tier>) under the canary rollout strategy (#657), so Scorecard Pinned-Dependencies cannot reach 10/10 by design. Third-party actions remain pinned via dependabot + enforced by compliance-audit.sh. Recurrence fix (teach org-scorecard to skip first-party refs) tracked in combsmith/.github#709.

  22. don-petry
    closed this as completedon Jul 14, 2026
  23. don-petry
    added 5 commits that reference this issue on Aug 4, 2026

    fix: address OpenSSF Scorecard findings

    8fc1d0f

    fix: address OpenSSF Scorecard findings

    b2b32b7

    feat: implement issue #407 — Compliance: ruleset-drift-pr-quality-req…

    ff2c20f

    fix: address OpenSSF Scorecard findings

    3024630

    fix: address OpenSSF Scorecard findings

    5220484
  24. don-petry
    added a commit that references this issue on Aug 18, 2026

    feat: implement issue #409 — Compliance: ruleset-drift-pr-quality-req…

    9f9be35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    dev-leadFor dev-lead agent pickupscorecardOpenSSF Scorecard finding

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions