Repository navigation
Scorecard: Pinned-Dependencies (4/10) #209
Description
OpenSSF Scorecard Finding
Check: Pinned-Dependencies
Score: 4 / 10
Finding: dependency not pinned by hash detected -- score normalized to 4
Remediation
Context
This issue was automatically created from an OpenSSF Scorecard scan on 2026-10-19.
Activity
don-petry commentedon Oct 20, 2026
Auto-closing (accepted exception, #709): this Pinned-Dependencies finding is limited to GitHub Actions refs. Third-party action pinning is enforced by
compliance-audit.sh(which exempts first-party), and our first-party reusable refs deliberately use mutable channel tags perci-standards.md#action-pinning-policy. No action needed.