Timur Tukaev 688f73f8f0 ci: pin Scorecard workflow actions by SHA ...

The initial Scorecard workflow used floating major-version tags
(@v2, @v4, @v3). ossf/scorecard-action does not publish a floating
v2 tag — only specific patch releases — so the first scheduled run
failed with `Unable to resolve action ossf/scorecard-action@v2`.

Pin every action by its full commit SHA with a trailing comment
showing the human-readable version. This also satisfies the
`Pinned-Dependencies` Scorecard check itself.

- actions/checkout@de0fac2 (v6.0.2)
- ossf/scorecard-action@4eaacf0 (v2.4.3)
- actions/upload-artifact@043fb46 (v7.0.1)
- github/codeql-action/upload-sarif@03e4368 (v3)

Signed-off-by: Timur Tukaev <timur.tukaev@aenix.io>

2026-05-23 09:25:31 +05:00

..

ISSUE_TEMPLATE

chore(ci): adopt CNCF/k8s label conventions

2026-04-27 03:15:09 +03:00

workflows

ci: pin Scorecard workflow actions by SHA

2026-05-23 09:25:31 +05:00

CODEOWNERS

chore(maintenance): add @myasnikovdaniil to CODEOWNERS

2026-04-21 14:31:07 +05:00

labels.yml

chore(ci): replace Dosu stale and size labeling with native workflows

2026-04-27 18:00:01 +03:00

PULL_REQUEST_TEMPLATE.md

docs(maintenance): mirror illustrative-scopes wording in PR template

2026-04-27 11:20:13 +03:00