chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4

.github/workflows/scorecard-analysis.yml

@@ -26,7 +26,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif

.github/workflows/scorecard-pr.yml

@@ -46,7 +46,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif

.github/workflows/security-scan.yml

@@ -408,7 +408,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif

CHANGELOG.md

@@ -26,6 +26,7 @@ Semantic Versioning where the repository publishes a release.
 
 ### Fixed
 
+- Pinned OpenSSF Scorecard to one immutable action SHA (`2d1146689b8cda280b9bc96326124645441f03bc`, v2.4.4) on both the PR visibility job and the default-branch analysis job so a Dependabot split cannot execute a second unreviewed control sphere (CWE-829).
 - Materialized base Python locks only when every package line is an exact SHA-256 pin or a bounded relative `-r`/`--requirement` include. A lone `--require-hashes` directive, a dotted include such as `./lock.txt`, or `-r other-hashes.txt` no longer enters the trusted build context.
 - Refused a conflict-scope repository root whose immediate parent is a symbolic link, so a swapped parent cannot redirect the canonical worktree after the last-component check (CWE-367).
 - Bounded the Strix quality self-test's deterministic timeout fixtures to 3-second process and 5-second fake-sleep budgets so exact-head policy evidence completes inside the existing job limit without changing production Strix scanner timeouts, providers, credentials, or review semantics.

docs/doctoring/scorecard-action-single-version.md

@@ -0,0 +1,25 @@
+# Scorecard action single-version pin
+
+## Incident and buyer impact
+
+Dependabot bumps `ossf/scorecard-action` one workflow at a time. If the
+PR visibility job and the default-branch analysis job execute different
+SHAs, a green Scorecard gate does not prove the scheduled posture scan
+used the reviewed action.
+
+## Decision
+
+Pin both `scorecard-pr.yml` and `scorecard-analysis.yml` to
+`2d1146689b8cda280b9bc96326124645441f03bc` (v2.4.4). A contract test
+rejects a split.
+
+CWE-829 forbids including functionality from an untrusted or unreviewed
+control sphere (MITRE, 2026). A second SHA is a second control sphere.
+
+## References
+
+MITRE. (2026). *CWE-829: Inclusion of functionality from untrusted
+control sphere*. https://cwe.mitre.org/data/definitions/829.html
+
+OpenSSF. (n.d.). *Scorecard action*. GitHub. Retrieved August 13, 2026,
+from https://github.com/ossf/scorecard-action

tests/test_scorecard_action_pin_contract.py

@@ -0,0 +1,35 @@
+"""Pin OpenSSF Scorecard to one immutable action SHA across workflows."""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+SCORECARD_SHA = "2d1146689b8cda280b9bc96326124645441f03bc"
+SCORECARD_TAG = "v2.4.4"
+_PIN = re.compile(
+    r"ossf/scorecard-action@([0-9a-f]{40}) # (v\d+\.\d+\.\d+)"
+)
+
+
+def test_scorecard_pr_and_analysis_share_one_action_sha() -> None:
+    """CWE-829: PR and scheduled Scorecard must execute one immutable SHA.
+
+    A Dependabot bump that updates only one workflow would analyze PRs with
+    a different trusted action than the default-branch posture job.
+    """
+    shas: set[str] = set()
+    tags: set[str] = set()
+    for filename in ("scorecard-pr.yml", "scorecard-analysis.yml"):
+        workflow = (REPO_ROOT / ".github/workflows" / filename).read_text(
+            encoding="utf-8"
+        )
+        pins = _PIN.findall(workflow)
+        assert pins, f"{filename} has no pinned ossf/scorecard-action"
+        for sha, tag in pins:
+            shas.add(sha)
+            tags.add(tag)
+
+    assert shas == {SCORECARD_SHA}
+    assert tags == {SCORECARD_TAG}