Timur Tukaev 688f73f8f0 ci: pin Scorecard workflow actions by SHA ...

The initial Scorecard workflow used floating major-version tags
(@v2, @v4, @v3). ossf/scorecard-action does not publish a floating
v2 tag — only specific patch releases — so the first scheduled run
failed with `Unable to resolve action ossf/scorecard-action@v2`.

Pin every action by its full commit SHA with a trailing comment
showing the human-readable version. This also satisfies the
`Pinned-Dependencies` Scorecard check itself.

- actions/checkout@de0fac2 (v6.0.2)
- ossf/scorecard-action@4eaacf0 (v2.4.3)
- actions/upload-artifact@043fb46 (v7.0.1)
- github/codeql-action/upload-sarif@03e4368 (v3)

Signed-off-by: Timur Tukaev <timur.tukaev@aenix.io>

2026-05-23 09:25:31 +05:00

..

auto-release.yaml

ci: use cozystack org noreply email for bot commits

2026-04-13 16:29:07 +02:00

backport.yaml

fix(ci): stop backport workflow from cascading on its own PRs

2026-05-06 18:09:09 +05:00

codegen-drift.yml

ci(api): broaden codegen drift trigger paths and detect untracked files

2026-04-23 22:19:35 +05:00

labels.yaml

chore(ci): adopt CNCF/k8s label conventions

2026-04-27 03:15:09 +03:00

pr-labeler.yaml

fix(ci): stop backport workflow from cascading on its own PRs

2026-05-06 18:09:09 +05:00

pr-size.yaml

chore(ci): replace Dosu stale and size labeling with native workflows

2026-04-27 18:00:01 +03:00

pre-commit.yml

ci(pre-commit): bump cozyvalues-gen to v1.4.0

2026-05-21 16:04:08 +05:00

pull-requests-release.yaml

fix(ci): pass app token to Publish draft release step

2026-04-29 15:47:41 +05:00

pull-requests.yaml

ci(workflows): rebuild breakpoint authorized-users from active contributors

2026-05-20 16:17:08 +02:00

retest.yaml

feat(ci): add /retest command to rerun tests from Prepare environment

2026-01-02 21:23:27 +01:00

scorecard.yml

ci: pin Scorecard workflow actions by SHA

2026-05-23 09:25:31 +05:00

stale.yaml

fix(ci): exempt priority/important-longterm from issue staling

2026-04-27 18:40:34 +03:00

tags.yaml

ci(tags): include data/versions in website docs commit

2026-05-21 12:16:10 +05:00

update-releasenotes.yaml

[workflow] Add GitHub Action to update release notes from changelogs

2025-12-24 15:02:04 +01:00