From cbce0a6ccfd58c61bec09416a04a15f2a2ee90b3 Mon Sep 17 00:00:00 2001 From: Win Huang Date: Thu, 16 Apr 2026 12:26:54 +0800 Subject: [PATCH] Fix Scorecard action hash: use commit SHA, not tag object SHA The previous hash ea651e6... pointed to the annotated tag object, not the actual commit. Scorecard's workflow verification rejects tag object SHAs as "imposter commits". Dereferenced to the real commit f49aabe... that the v2.4.1 tag points to. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 8f8ee5f..40416fd 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -47,7 +47,7 @@ jobs: persist-credentials: false - name: Run Scorecard - uses: ossf/scorecard-action@ea651e62978af7915d09fe2e282747c798bf2dab # v2.4.1 + uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1 with: results_file: results.sarif results_format: sarif