From bf9fd981370602d026f9071e58ec629d8e7e56a1 Mon Sep 17 00:00:00 2001 From: only-cli Date: Wed, 19 Aug 2026 16:25:14 -0400 Subject: [PATCH] fix scorecard-action pin: v2 doesn't exist as a tag upstream ossf/scorecard-action only publishes point-release tags (v2.4.4, etc), no floating v2 major tag, so the workflow failed to even resolve the action and never published results -- which is why the README badge showed "invalid repo path". Pin to the v2.4.4 commit SHA instead. --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 36f57dd..8d5acfa 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -26,7 +26,7 @@ jobs: with: persist-credentials: false - - uses: ossf/scorecard-action@v2 + - uses: ossf/scorecard-action@55891bbd73f2425e97637d96e306fc9d491d0b21 # v2.4.4 with: results_file: results.sarif results_format: sarif