fix(scorecard): pin python-scorecard.yml to explicit SHA (was @main)#36
fix(scorecard): pin python-scorecard.yml to explicit SHA (was @main)#36williaby wants to merge 1 commit into
Conversation
Replaces the floating @main ref with the explicit commit SHA f05c26a424a708a73fc445a0ebb5b3ce476c1793 of ByronWilliamsCPA/.github. This SHA hard-codes publish_results: false, fixing the OIDC token repository claim bug. Pinning to a SHA also eliminates the supply-chain risk of silent behavior changes on future commits to .github main. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
There was a problem hiding this comment.
Pull request overview
Pins the repository’s OpenSSF Scorecard GitHub Actions workflow to an immutable reusable-workflow reference to avoid unintended behavior changes from tracking a moving branch.
Changes:
- Updated the reusable workflow reference from
@mainto a full commit SHA forByronWilliamsCPA/.github/.github/workflows/python-scorecard.yml.
| uses: ByronWilliamsCPA/.github/.github/workflows/python-scorecard.yml@f05c26a424a708a73fc445a0ebb5b3ce476c1793 | ||
| with: | ||
| publish-results: true | ||
| upload-sarif: true |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Summary
@mainref withf05c26a424a708a73fc445a0ebb5b3ce476c1793(current HEAD ofByronWilliamsCPA/.github).githubmain advancespublish_results: false, fixing the OIDC tokenrepositoryclaim bug for reusable workflow calleesGenerated with Claude Code