{"date":"2026-08-17","repo":{"name":"github.com/SeldonIO/seldon-core","commit":"402619eb9064b2ced678539fa3c0a1a0bd8f723a"},"scorecard":{"version":"v5.5.1-0.20260815060127-d1fab88f5463","commit":"d1fab88f54636ff366076edfc5c239f97b3c8e66"},"score":4.6,"checks":[{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#maintained"}},{"name":"Code-Review","score":9,"reason":"Found 29/30 approved changesets -- score normalized to 9","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#code-review"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#cii-best-practices"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: jobLevel 'contents' permission set to 'write': .github/workflows/draft-release.yml:19","Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/pr-title.yaml:17","Warn: no topLevel permission defined: .github/workflows/changelog.yml:1","Warn: no topLevel permission defined: .github/workflows/draft-release.yml:1","Warn: no topLevel permission defined: .github/workflows/gb-docs.yml:1","Warn: no topLevel permission defined: .github/workflows/images.yml:1","Warn: no topLevel permission defined: .github/workflows/license.yml:1","Warn: no topLevel permission defined: .github/workflows/lint.yml:1","Warn: no topLevel permission defined: .github/workflows/pr-title.yaml:1","Warn: no topLevel permission defined: .github/workflows/security_tests_v2.yml:1","Warn: no topLevel permission defined: .github/workflows/tests.yml:1"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":9,"reason":"binaries present in source code","details":["Warn: binary detected: scheduler/data-flow/gradle/wrapper/gradle-wrapper.jar:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#binary-artifacts"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#security-policy"}},{"name":"License","score":9,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Warn: project license file does not contain an FSF or OSI license."],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#fuzzing"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v2.10.2 not signed: https://api.github.com/repos/SeldonIO/seldon-core/releases/271540470","Warn: release artifact v2.10.1 not signed: https://api.github.com/repos/SeldonIO/seldon-core/releases/255763805","Warn: release artifact v2.10.0 not signed: https://api.github.com/repos/SeldonIO/seldon-core/releases/252883827","Warn: release artifact v2.10.2 does not have provenance: https://api.github.com/repos/SeldonIO/seldon-core/releases/271540470","Warn: release artifact v2.10.1 does not have provenance: https://api.github.com/repos/SeldonIO/seldon-core/releases/255763805","Warn: release artifact v2.10.0 does not have provenance: https://api.github.com/repos/SeldonIO/seldon-core/releases/252883827"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#branch-protection"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/images.yml:36"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#packaging"}},{"name":"SAST","score":10,"reason":"SAST tool detected","details":["Info: SAST configuration detected: Snyk","Info: SAST configuration detected: Snyk","Info: SAST configuration detected: Snyk","Info: SAST configuration detected: Snyk","Info: SAST configuration detected: Snyk","Info: SAST configuration detected: Snyk","Info: SAST configuration detected: Snyk","Info: SAST configuration detected: Snyk","Info: SAST configuration detected: Snyk","Warn: 0 commits out of 29 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#sast"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/changelog.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/changelog.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/changelog.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/changelog.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/changelog.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/changelog.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/draft-release.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/draft-release.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/draft-release.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/draft-release.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/draft-release.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/draft-release.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/draft-release.yml:78: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/draft-release.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/draft-release.yml:98: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/draft-release.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/draft-release.yml:136: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/draft-release.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/gb-docs.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/gb-docs.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/gb-docs.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/gb-docs.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/gb-docs.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/gb-docs.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/gb-docs.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/gb-docs.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/gb-docs.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/gb-docs.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/gb-docs.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/gb-docs.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/images.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/images.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/images.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/images.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/images.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/images.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/images.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/images.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/images.yml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/images.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/license.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/license.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/license.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/license.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/license.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/license.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/license.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/license.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/lint.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/lint.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/lint.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/lint.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/lint.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/lint.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/lint.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/lint.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/lint.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/lint.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:65: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:75: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:82: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:92: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:99: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:177: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:184: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:109: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:116: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:126: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:133: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:143: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:150: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:160: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/security_tests_v2.yml:167: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/security_tests_v2.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/tests.yml/v2?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/SeldonIO/seldon-core/tests.yml/v2?enable=pin","Warn: containerImage not pinned by hash: hodometer/Dockerfile.hodometer:1: pin your Docker image by updating golang:1.24-bullseye to golang:1.24-bullseye@sha256:2cdc80dc25edcb96ada1654f73092f2928045d037581fa4aa7c40d18af7dd85a","Warn: containerImage not pinned by hash: hodometer/Dockerfile.hodometer:25: pin your Docker image by updating registry.access.redhat.com/ubi9/ubi-micro:9.6 to registry.access.redhat.com/ubi9/ubi-micro:9.6@sha256:990002083442f6a93cd3249da32ecb7c3f6be778a1bec3a73a9c17fbc40edc15","Warn: containerImage not pinned by hash: hodometer/Dockerfile.receiver:1: pin your Docker image by updating golang:1.24-alpine to golang:1.24-alpine@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191","Warn: containerImage not pinned by hash: hodometer/Dockerfile.receiver:21: pin your Docker image by updating registry.access.redhat.com/ubi9/ubi-micro:9.6 to registry.access.redhat.com/ubi9/ubi-micro:9.6@sha256:990002083442f6a93cd3249da32ecb7c3f6be778a1bec3a73a9c17fbc40edc15","Warn: containerImage not pinned by hash: operator/Dockerfile:2: pin your Docker image by updating golang:1.24 to golang:1.24@sha256:d2d2bc1c84f7e60d7d2438a3836ae7d0c847f4888464e7ec9ba3a1339a1ee804","Warn: containerImage not pinned by hash: operator/Dockerfile:13: pin your Docker image by updating registry.access.redhat.com/ubi9/ubi-micro:9.6 to registry.access.redhat.com/ubi9/ubi-micro:9.6@sha256:990002083442f6a93cd3249da32ecb7c3f6be778a1bec3a73a9c17fbc40edc15","Warn: containerImage not pinned by hash: operator/Dockerfile.cli:2: pin your Docker image by updating golang:1.24 to golang:1.24@sha256:d2d2bc1c84f7e60d7d2438a3836ae7d0c847f4888464e7ec9ba3a1339a1ee804","Warn: containerImage not pinned by hash: operator/Dockerfile.cli:12","Warn: containerImage not pinned by hash: operator/Dockerfile.cli:14: pin your Docker image by updating registry.access.redhat.com/ubi9/ubi-micro:9.6 to registry.access.redhat.com/ubi9/ubi-micro:9.6@sha256:990002083442f6a93cd3249da32ecb7c3f6be778a1bec3a73a9c17fbc40edc15","Warn: containerImage not pinned by hash: scheduler/Dockerfile.agent:1: pin your Docker image by updating golang:1.24-alpine to golang:1.24-alpine@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191","Warn: containerImage not pinned by hash: scheduler/Dockerfile.agent:13: pin your Docker image by updating registry.access.redhat.com/ubi9/ubi-micro:9.6 to registry.access.redhat.com/ubi9/ubi-micro:9.6@sha256:990002083442f6a93cd3249da32ecb7c3f6be778a1bec3a73a9c17fbc40edc15","Warn: containerImage not pinned by hash: scheduler/Dockerfile.dataflow:1: pin your Docker image by updating azul/zulu-openjdk-alpine:17-latest to azul/zulu-openjdk-alpine:17-latest@sha256:81360486e3fa74f9be36c97f112c753664dc547b07030b558795e5d58a06f905","Warn: containerImage not pinned by hash: scheduler/Dockerfile.dataflow:19: pin your Docker image by updating registry.access.redhat.com/ubi9/openjdk-17-runtime:1.22 to registry.access.redhat.com/ubi9/openjdk-17-runtime:1.22@sha256:090c25d45ef1d6420b12b805b1f09d2faa4cbc1553321b9de3c71cb4f3c1f5f4","Warn: containerImage not pinned by hash: scheduler/Dockerfile.envoy:1: pin your Docker image by updating envoyproxy/envoy:v1.34.1 to envoyproxy/envoy:v1.34.1@sha256:007da57c2c328a90bd4e6d99b70bd899132f1b4a9426ccafe25437cf84a60c14","Warn: containerImage not pinned by hash: scheduler/Dockerfile.envoy:3: pin your Docker image by updating registry.access.redhat.com/ubi9/ubi-micro:9.6 to registry.access.redhat.com/ubi9/ubi-micro:9.6@sha256:990002083442f6a93cd3249da32ecb7c3f6be778a1bec3a73a9c17fbc40edc15","Warn: containerImage not pinned by hash: scheduler/Dockerfile.grafana:1: pin your Docker image by updating grafana/grafana:12.0.2 to grafana/grafana:12.0.2@sha256:b5b59bfc7561634c2d7b136c4543d702ebcc94a3da477f21ff26f89ffd4214fa","Warn: containerImage not pinned by hash: scheduler/Dockerfile.modelgateway:1: pin your Docker image by updating golang:1.24-bullseye to golang:1.24-bullseye@sha256:2cdc80dc25edcb96ada1654f73092f2928045d037581fa4aa7c40d18af7dd85a","Warn: containerImage not pinned by hash: scheduler/Dockerfile.modelgateway:13","Warn: containerImage not pinned by hash: scheduler/Dockerfile.modelgateway:16: pin your Docker image by updating registry.access.redhat.com/ubi9/ubi-micro:9.6 to registry.access.redhat.com/ubi9/ubi-micro:9.6@sha256:990002083442f6a93cd3249da32ecb7c3f6be778a1bec3a73a9c17fbc40edc15","Warn: containerImage not pinned by hash: scheduler/Dockerfile.pipelinegateway:1: pin your Docker image by updating golang:1.24-bullseye to golang:1.24-bullseye@sha256:2cdc80dc25edcb96ada1654f73092f2928045d037581fa4aa7c40d18af7dd85a","Warn: containerImage not pinned by hash: scheduler/Dockerfile.pipelinegateway:13","Warn: containerImage not pinned by hash: scheduler/Dockerfile.pipelinegateway:16: pin your Docker image by updating registry.access.redhat.com/ubi9/ubi-micro:9.6 to registry.access.redhat.com/ubi9/ubi-micro:9.6@sha256:990002083442f6a93cd3249da32ecb7c3f6be778a1bec3a73a9c17fbc40edc15","Warn: containerImage not pinned by hash: scheduler/Dockerfile.rclone:1: pin your Docker image by updating rclone/rclone:1.71.1 to rclone/rclone:1.71.1@sha256:d5971950c2b370fb04dd3292541b5bda6d9103143fd7e345aeb435a399388afc","Warn: containerImage not pinned by hash: scheduler/Dockerfile.rclone:5: pin your Docker image by updating registry.access.redhat.com/ubi9/ubi-minimal:9.6 to registry.access.redhat.com/ubi9/ubi-minimal:9.6@sha256:34880b64c07f28f64d95737f82f891516de9a3b43583f39970f7bf8e4cfa48b7","Warn: containerImage not pinned by hash: scheduler/Dockerfile.scheduler:1: pin your Docker image by updating golang:1.24-bullseye to golang:1.24-bullseye@sha256:2cdc80dc25edcb96ada1654f73092f2928045d037581fa4aa7c40d18af7dd85a","Warn: containerImage not pinned by hash: scheduler/Dockerfile.scheduler:13: pin your Docker image by updating registry.access.redhat.com/ubi9/ubi-micro:9.6 to registry.access.redhat.com/ubi9/ubi-micro:9.6@sha256:990002083442f6a93cd3249da32ecb7c3f6be778a1bec3a73a9c17fbc40edc15","Warn: containerImage not pinned by hash: tests/k6/Dockerfile.k6:5: pin your Docker image by updating alpine:3.19.1 to alpine:3.19.1@sha256:c5b1261d6d3e43071626931fc004f70149baeba2c8ec672bd4f27761f8e1ad6b","Warn: containerImage not pinned by hash: tests/k6/Dockerfile.k6:16: pin your Docker image by updating grafana/k6:1.1.0 to grafana/k6:1.1.0@sha256:aa8202f377550cee0c8bad295bbe8d2d4d4cf88d15c98383e9ecc53c56882308","Warn: downloadThenRun not pinned by hash: tests/k6/Dockerfile.k6:13","Warn: downloadThenRun not pinned by hash: .github/workflows/draft-release.yml:84","Warn: npmCommand not pinned by hash: .github/workflows/draft-release.yml:105","Info:   0 out of  30 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of  22 third-party GitHubAction dependencies pinned","Info:   0 out of   2 downloadThenRun dependencies pinned","Info:   0 out of   1 npmCommand dependencies pinned","Info:   0 out of  28 containerImage dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#pinned-dependencies"}}]}