Repository navigation
Scorecard: Pinned-Dependencies (8/10) #274
Description
OpenSSF Scorecard Finding
Check: Pinned-Dependencies
Score: 8 / 10
Finding: dependency not pinned by hash detected -- score normalized to 8
Remediation
Context
This issue was automatically created from an OpenSSF Scorecard scan on 2026-06-15.
Activity
don-petry commentedon Jun 22, 2026
Weekly update: Score is now 4/10. Finding: dependency not pinned by hash detected -- score normalized to 4
don-petry commentedon Jun 29, 2026
Weekly update: Score is now 4/10. Finding: dependency not pinned by hash detected -- score normalized to 4
don-petry commentedon Jul 6, 2026
Weekly update: Score is now 4/10. Finding: dependency not pinned by hash detected -- score normalized to 4
don-petry commentedon Jul 13, 2026
Weekly update: Score is now 4/10. Finding: dependency not pinned by hash detected -- score normalized to 4
don-petry commentedon Jul 14, 2026
Closing as accepted exception. First-party reusable-workflow refs intentionally use mutable channel tags (
<agent>/v<M>-<tier>) under the canary rollout strategy (#657), so Scorecard Pinned-Dependencies cannot reach 10/10 by design. Third-party actions remain pinned via dependabot + enforced bycompliance-audit.sh. Recurrence fix (teach org-scorecard to skip first-party refs) tracked in combsmith/.github#709.