only-cli bf9fd98137 fix scorecard-action pin: v2 doesn't exist as a tag upstream ...

ossf/scorecard-action only publishes point-release tags (v2.4.4, etc),
no floating v2 major tag, so the workflow failed to even resolve the
action and never published results -- which is why the README badge
showed "invalid repo path". Pin to the v2.4.4 commit SHA instead.

2026-08-19 16:25:14 -04:00

..

ci.yml

ci: align setup-node with v7 used elsewhere

2026-08-18 10:02:24 -04:00

codeql.yml

harden CI: CodeQL, dependency review, npm provenance, OpenSSF Scorecard

2026-08-19 16:21:46 -04:00

dependency-review.yml

harden CI: CodeQL, dependency review, npm provenance, OpenSSF Scorecard

2026-08-19 16:21:46 -04:00

publish.yml

harden CI: CodeQL, dependency review, npm provenance, OpenSSF Scorecard

2026-08-19 16:21:46 -04:00

scorecard.yml

fix scorecard-action pin: v2 doesn't exist as a tag upstream

2026-08-19 16:25:14 -04:00