From d95feffbca170b40a51ae765f40d2239fc23dbf8 Mon Sep 17 00:00:00 2001 From: adrian adewunmi Date: Thu, 16 Jul 2026 08:34:31 +0100 Subject: [PATCH] ci(scorecard): fix workflow artifact handling and pin action SHAs --- .github/workflows/scorecard.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 64ce85f3..fbe3fd2d 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -59,7 +59,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: # Use a simple, lowercase artifact name without spaces to avoid API validation name: results-sarif @@ -79,7 +79,7 @@ jobs: runs-on: ubuntu-latest steps: - name: "Download SARIF artifact" - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 with: name: results-sarif