chore(security): unify Scorecard Action v2.4.4

[seonghobae]

Outcome

Pins every central OpenSSF Scorecard Action use to the full commit referenced by the official signed v2.4.4 tag. This is a clean current-main replacement for stale #920 and keeps pull-request, scheduled, and combined security scans on one reviewed artifact.

Supersedes #920.

Verification

• TDD repository-wide pin contract failed on v2.4.3 and passed after alignment
• 1,394 passed, 1 skipped
• 8,346 statements / 3,214 branches at 100% coverage
• docstring coverage 100%
• actionlint passed for all three changed workflows
• workflow shell-syntax contracts passed in the full suite
• git diff --check passed

Provenance

The official signed v2.4.4 tag resolves to 2d1146689b8cda280b9bc96326124645441f03bc. The doctoring record cites the official release and GitHub immutable-SHA guidance in APA 7th form.

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a73c80dd-64e6-4bcc-8a13-e6cbb680dfe3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Implemented on exact head . The Scorecard pin contract now scans both and workflow files and only treats lines containing as action references. Targeted contract test passed; passed.

[seonghobae]

Implemented on exact head c17d252. The Scorecard pin contract now scans both yml and yaml workflow files and only treats lines containing uses as action references. Targeted contract test passed. git diff check passed.

[seonghobae]

Exact-head RCA: Strix run 32689044125 checked out c17d252, then failed closed after NVIDIA NIM provider infrastructure output and the protected-base openai-direct fallback alias was rejected by LiteLLM. No source finding was produced. This is not approval evidence; the PR remains blocked pending the prerequisite provider repair, fresh exact-head checks, and formal review.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for dd545212c105b285ba7be548e0199828a8085782.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32717041547/job/97400389118)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32717041547/job/97400389118)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (3 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (3 files)"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: scorecard-action-single-version.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: scorecard-action-single-version.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["Test: test_scorecard_action_pin_contract.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_scorecard_action_pin_contract.py"]
  R4 --> V4["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: dd545212c105b285ba7be548e0199828a8085782
• Workflow run: 32745822983
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for dd545212c105b285ba7be548e0199828a8085782.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32717041547/job/97400389118)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32717041547/job/97400389118)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (3 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (3 files)"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: scorecard-action-single-version.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: scorecard-action-single-version.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["Test: test_scorecard_action_pin_contract.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_scorecard_action_pin_contract.py"]
  R4 --> V4["targeted test run"]

Loading

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for dd545212c105b285ba7be548e0199828a8085782.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32717041547/job/97400389118)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32717041547/job/97400389118)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (3 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (3 files)"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: scorecard-action-single-version.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: scorecard-action-single-version.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["Test: test_scorecard_action_pin_contract.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_scorecard_action_pin_contract.py"]
  R4 --> V4["targeted test run"]

Loading