ci(#600): pin ossf/scorecard-action to v2.4.3#601
Conversation
The floating @v2 major tag no longer resolves ("unable to find version v2"), failing the Scorecard workflow on every push to main (seen on the v3.1.0 release merge, run 27188194993). Pin to the latest published release v2.4.3. Closes #600 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
|
||
| - name: Run analysis | ||
| uses: ossf/scorecard-action@v2 | ||
| uses: ossf/scorecard-action@v2.4.3 |
atlas-apex
left a comment
There was a problem hiding this comment.
Code Review: PR #601
Commit: 4d2d8366fdd2f3208227a7299bd1e809fd91df36
Summary
One-line CI fix pinning ossf/scorecard-action@v2 → @v2.4.3 in .github/workflows/scorecard.yml. The floating v2 major tag no longer resolves, breaking the Scorecard job at setup on push-to-main.
Checklist Results
- Architecture & Design: N/A (CI config)
- Code Quality: Pass
- Testing: Pass (CI verifies action resolution + SARIF upload)
- Security: Pass — pins a floating tag to an immutable release; improves supply-chain posture
- Performance: N/A
- PR Description & Glossary: Pass (Summary + Testing + Glossary + Closes #600)
- Summary Bullet Narrative: Pass (bullets state what changed + why it matters)
- Technical Decisions (AgDR):N/A (version pin matching existing #590 pattern, no new tool choice)
- Adopter Handbooks: N/A (no handbook globs match a workflow-only diff)
Verification
- Diff is exactly the single-line pin (+1/-1), only file is
scorecard.yml. ossf/scorecard-action@v2.4.3is a real published release (2025-09-30), confirmed via the GitHub releases API.- The only
scorecard-actionref in the workflow is the one being pinned — no other action refs touched. - Closes #600 (OPEN, title matches the PR intent).
- Commit SHA matches PR HEAD.
Issues Found
None.
Suggestions
nit (non-blocking, future hardening): for strongest supply-chain posture, OpenSSF's own guidance is to pin actions to a full commit SHA (ossf/scorecard-action@<sha> # v2.4.3) rather than a semver tag, since tags are mutable. The semver pin here already fixes the immediate breakage and matches the existing repo convention (#590), so this is purely optional follow-up.
Verdict
APPROVED
🤖 Reviewed by Rex (Code Reviewer Agent)
📌 Reviewed commit: 4d2d8366fdd2f3208227a7299bd1e809fd91df36
Summary
ossf/scorecard-action@v2→@v2.4.3in.github/workflows/scorecard.yml. The floatingv2major tag is no longer published by the action, so the Scorecard job failed at setup on everypushtomainwithunable to find version v2(observed on the v3.1.0 release merge, run 27188194993).Testing
push-to-main(or a manualworkflow_dispatch) Scorecard run completes and uploads SARIF.Closes #600
Glossary
v2) pointing at the latestv2.x; references break when the publisher stops maintaining it.