chore(security): unify Scorecard Action v2.4.4

[seonghobae]

Outcome

Pins every central OpenSSF Scorecard Action use to the full commit referenced by the official signed v2.4.4 tag. This is a clean current-main replacement for stale #920 and keeps pull-request, scheduled, and combined security scans on one reviewed artifact.

Supersedes #920.

Verification

• TDD repository-wide pin contract failed on v2.4.3 and passed after alignment
• 1,394 passed, 1 skipped
• 8,346 statements / 3,214 branches at 100% coverage
• docstring coverage 100%
• actionlint passed for all three changed workflows
• workflow shell-syntax contracts passed in the full suite
• git diff --check passed

Provenance

The official signed v2.4.4 tag resolves to 2d1146689b8cda280b9bc96326124645441f03bc. The doctoring record cites the official release and GitHub immutable-SHA guidance in APA 7th form.

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0d32424e-fd72-4447-9bab-8d4e28a2c6c8

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Implemented on exact head . The Scorecard pin contract now scans both and workflow files and only treats lines containing as action references. Targeted contract test passed; passed.

[seonghobae]

Implemented on exact head c17d252. The Scorecard pin contract now scans both yml and yaml workflow files and only treats lines containing uses as action references. Targeted contract test passed. git diff check passed.

[seonghobae]

Exact-head RCA: Strix run 32689044125 checked out c17d252, then failed closed after NVIDIA NIM provider infrastructure output and the protected-base openai-direct fallback alias was rejected by LiteLLM. No source finding was produced. This is not approval evidence; the PR remains blocked pending the prerequisite provider repair, fresh exact-head checks, and formal review.