Repository navigation
Scorecard: Pinned-Dependencies (6/10) #87
Description
OpenSSF Scorecard Finding
Check: Pinned-Dependencies
Score: 6 / 10
Finding: dependency not pinned by hash detected
Remediation
Context
This issue was automatically created from an OpenSSF Scorecard scan on 2026-03-27.
Activity
fix: address OpenSSF Scorecard findings
fix: address OpenSSF Scorecard findings (#91)
claude commentedon Apr 5, 2026
Claude Code is working…
I'll analyze this and get back to you.
View job run
don-petry commentedon May 17, 2026
Weekly update: Score is now 6/10. Finding: dependency not pinned by hash detected -- score normalized to 6
don-petry commentedon May 17, 2026
Weekly update: Score is now 6/10. Finding: dependency not pinned by hash detected -- score normalized to 6
don-petry commentedon May 17, 2026
Weekly update: Score is now 6/10. Finding: dependency not pinned by hash detected -- score normalized to 6
don-petry commentedon May 17, 2026
Weekly update: Score is now 6/10. Finding: dependency not pinned by hash detected -- score normalized to 6
don-petry commentedon May 18, 2026
Weekly update: Score is now 6/10. Finding: dependency not pinned by hash detected -- score normalized to 6
don-petry commentedon May 25, 2026
Weekly update: Score is now 8/10. Finding: dependency not pinned by hash detected -- score normalized to 8
don-petry commentedon Jun 1, 2026
Weekly update: Score is now 8/10. Finding: dependency not pinned by hash detected -- score normalized to 8
don-petry commentedon Jun 6, 2026
Dev-Lead Implementation Plan
Issue: #87 — Scorecard: Pinned-Dependencies (6/10)
Scope
Pin all GitHub Actions workflow
uses:references to specific commit SHAs instead of mutable version tags (@v2) or branch names (@main) to satisfy the OpenSSF Scorecard Pinned-Dependencies check.Implementation Checklist
.github/workflows/pr-auto-review.yml— replace@v2with@376a4fcb1117444595e3e702fa450873d0e54310.github/workflows/dependency-audit.yml— replace@v2with@376a4fcb1117444595e3e702fa450873d0e54310.github/workflows/dependabot-automerge.yml— replace@v2with@376a4fcb1117444595e3e702fa450873d0e54310.github/workflows/pr-review.yml— replace@mainwith@7b0426146444d97550dcca89d86984b809288506.github/workflows/dev-lead.yml— replace@mainwith@7b0426146444d97550dcca89d86984b809288506Tests to Write
Test Command
npm testSHA Resolution
petry-projects/.github@v2→376a4fcb1117444595e3e702fa450873d0e54310(confirmed viagh api repos/petry-projects/.github/git/ref/tags/v2)petry-projects/.github-private@main→7b0426146444d97550dcca89d86984b809288506(confirmed viagh api repos/petry-projects/.github-private/git/ref/heads/main)5 remaining items
don-petry commentedon Jun 15, 2026
Weekly update: Score is now 7/10. Finding: dependency not pinned by hash detected -- score normalized to 7
don-petry commentedon Jun 22, 2026
Weekly update: Score is now 6/10. Finding: dependency not pinned by hash detected -- score normalized to 6
don-petry commentedon Jun 29, 2026
Weekly update: Score is now 6/10. Finding: dependency not pinned by hash detected -- score normalized to 6
don-petry commentedon Jul 6, 2026
Weekly update: Score is now 5/10. Finding: dependency not pinned by hash detected -- score normalized to 5
don-petry commentedon Jul 13, 2026
Weekly update: Score is now 5/10. Finding: dependency not pinned by hash detected -- score normalized to 5
don-petry commentedon Jul 14, 2026
Closing as accepted exception. First-party reusable-workflow refs intentionally use mutable channel tags (
<agent>/v<M>-<tier>) under the canary rollout strategy (#657), so Scorecard Pinned-Dependencies cannot reach 10/10 by design. Third-party actions remain pinned via dependabot + enforced bycompliance-audit.sh. Recurrence fix (teach org-scorecard to skip first-party refs) tracked in combsmith/.github#709.fix: address OpenSSF Scorecard findings (#91)
feat: implement issue #442 — SonarCloud modernization (1/3): src/ app…
fix: address OpenSSF Scorecard findings (#91)
feat: implement issue #442 — SonarCloud modernization (1/3): src/ app…
fix: address OpenSSF Scorecard findings (#91)
feat: implement issue #442 — SonarCloud modernization (1/3): src/ app…
fix: address OpenSSF Scorecard findings (#91)
feat: implement issue #521 — Compliance: stub-surface-drift-pr-auto-r…