From 1d3ec1be2462efc3c8a2ae6b206e56ad53cb91cd Mon Sep 17 00:00:00 2001 From: Sanjay Shukla Date: Mon, 29 Jun 2026 12:11:52 -0700 Subject: [PATCH] ci: pin scorecard-action to v2.4.3 (no v2 tag exists) The Scorecard workflow failed at job setup: `ossf/scorecard-action@v2` does not resolve (the action publishes only specific version tags). Pin to v2.4.3 and bump the SARIF upload to codeql-action v4. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/scorecard.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index c07bc4f..9e20be1 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -24,13 +24,13 @@ jobs: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@v2 + uses: ossf/scorecard-action@v2.4.3 with: results_file: results.sarif results_format: sarif publish_results: true - name: Upload SARIF to code scanning - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: results.sarif