Backport workflow-hardening fix (unpinned-uses) to 5 release branches

[CharlieMCY]

Summary

The default branch already hardened .github/workflows/scorecards.yml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• unpinned-uses — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:

• 8103806

Affected release branches (5)

• release/v2.22 (still present as of HEAD f9beeb7b)
• release/v2.19 (still present as of HEAD 95531aa9)
• release/v2.17 (still present as of HEAD ea3e6428)
• release/v2.18 (still present as of HEAD 122e7914)
• release/v2.21 (still present as of HEAD 56be91e5)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release/v2.22 — unpinned-uses

File .github/workflows/scorecards.yml; suggested edits:

• ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J.steps[uses=github/codeql-action/upload-sarif].uses : pin(github/codeql-action/upload-sarif -> target_ref SHA)

--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -23,7 +23,7 @@
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           persist-credentials: false

release/v2.19 — unpinned-uses

File .github/workflows/scorecards.yml; suggested edits:

• ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J.steps[uses=github/codeql-action/upload-sarif].uses : pin(github/codeql-action/upload-sarif -> target_ref SHA)

--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -23,7 +23,7 @@
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           persist-credentials: false

release/v2.17 — unpinned-uses

File .github/workflows/scorecards.yml; suggested edits:

• ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J.steps[uses=github/codeql-action/upload-sarif].uses : pin(github/codeql-action/upload-sarif -> target_ref SHA)

--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -23,7 +23,7 @@
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           persist-credentials: false

release/v2.18 — unpinned-uses

File .github/workflows/scorecards.yml; suggested edits:

• ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J.steps[uses=github/codeql-action/upload-sarif].uses : pin(github/codeql-action/upload-sarif -> target_ref SHA)

--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -23,7 +23,7 @@
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           persist-credentials: false

release/v2.21 — unpinned-uses

File .github/workflows/scorecards.yml; suggested edits:

• ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J.steps[uses=github/codeql-action/upload-sarif].uses : pin(github/codeql-action/upload-sarif -> target_ref SHA)

--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -23,7 +23,7 @@
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           persist-credentials: false

---

Happy to open pull requests instead if that's preferred.