ci: replace imposter codeql-action SHA with real v4 pin#17
Merged
Conversation
Follow-up to PR #16. The publish_results fix in #16 will let the workflow try to publish on the next Monday scheduled run. But the pinned SHA on github/codeql-action/upload-sarif is an imposter commit per OSSF Scorecard's anti-supply-chain check, and the publish step would fail with: imposter commit: d4b3ca9fa7f69d38bfcd667bdc45bc373d16277e does not belong to github/codeql-action/upload-sarif Swap to the real v4 tag commit 68bde559dea0fdcac2102bfdf6230c5f70eb485e, verified via gh api. The same imposter pin propagated from repo-template into every repo born from it. Companion fixes: - repo-template PR #11 (open) - claude-teams-operator PR #228 (open) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-Authored-By: amcheste <13696614+amcheste@users.noreply.github.com>
amcheste
approved these changes
May 12, 2026
Owner
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to PR #16. The
publish_resultsfix in #16 will let the Scorecard workflow try to publish on the next Monday scheduled run (the first time this repo has published since the develop-default branch was set). But the pinned SHA ongithub/codeql-action/upload-sarifis an imposter commit per OSSF Scorecard's anti-supply-chain check, so the publish would fail at the SARIF upload step with:(Already verified failing on
claude-teams-operatorfor the same reason since at least 2026-04-29.)Fix
The new SHA is the real v4 tag commit, verified via:
Cross-repo status
The same imposter SHA propagated from
repo-templateinto every repo born from it. Companion fixes:repo-template— PR #11 (open, includes both publish_results + SHA fixes)claude-teams-operator— PR #228 (open, includes table-cell em-dash sweep + scorecard fixes)Verification
git diff develop --name-only→ exactly.github/workflows/scorecard.yml.No-Linear-Issue: follow-up to PR #16, propagating cross-family scorecard SHA fix
🤖 Generated with Claude Code