Configure OpenSSF Scorecard's `Pinned-Dependencies` check to block CI
- Dominant language
- Rust
- Stars
- 2.6k
- Forks
- 179
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 29
Description
OpenSSF Scorecard is [configured on this repository](https://github.com/google/zerocopy/blob/1552df2cd5f093c0f4d69de352fb642b1c42be3f/.github/workflows/scorecard.yml), but it only runs periodically and generates reports like this one (inserting screen shots since these alerts are not publicly viewable):
It would be better if we could block PRs if they fail this check.
## Mentoring instructions
*Interested in contributing? See our [contributing guide](https://github.com/google/zerocopy/discussions/1318).*
- [ ] Figure out how to run the [Pinned-Dependency](https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies) check [in CI](https://github.com/google/zerocopy/blob/1552df2cd5f093c0f4d69de352fb642b1c42be3f/.github/workflows/ci.yml)
- [ ] Ensure all dependencies reported by this check are pinned
Contributor guide
Assessment
This issue has not been assessed yet.