{"date":"2026-08-17","repo":{"name":"github.com/dolthub/dolt","commit":"86039deef719f2d4efc54a52a5e7a569d7310803"},"scorecard":{"version":"v5.5.1-0.20260815060127-d1fab88f5463","commit":"d1fab88f54636ff366076edfc5c239f97b3c8e66"},"score":5.5,"checks":[{"name":"Maintained","score":10,"reason":"30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#maintained"}},{"name":"Code-Review","score":8,"reason":"Found 12/15 approved changesets -- score normalized to 8","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#code-review"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":9,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#security-policy"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#license"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#dangerous-workflow"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#branch-protection"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/bump-dependency.yaml:1","Warn: no topLevel permission defined: .github/workflows/cd-bump-winget.yaml:1","Warn: no topLevel permission defined: .github/workflows/cd-create-release-notes.yaml:1","Warn: no topLevel permission defined: .github/workflows/cd-push-docker-image.yaml:1","Warn: no topLevel permission defined: .github/workflows/cd-release-pgo.yaml:1","Warn: no topLevel permission defined: .github/workflows/cd-release.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-bats-macos.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-bats-unix-remote.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-bats-unix.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-bats-windows.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-benchmark-runner-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-binlog-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-check-correctness.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-check-performance.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-check-repo.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-compatibility-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-data-dump-loading-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-go-race-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-go-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-lambdabats-unix.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-mysql-client-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-orm-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-sql-server-integration-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/doltgres-dependency.yml:1","Warn: no topLevel permission defined: .github/workflows/email-report.yaml:1","Warn: no topLevel permission defined: .github/workflows/import-benchmarks-pull-report.yaml:1","Warn: no topLevel permission defined: .github/workflows/import-perf.yaml:1","Warn: no topLevel permission defined: .github/workflows/k8s-benchmark-latency.yaml:1","Warn: no topLevel permission defined: .github/workflows/k8s-dolt-profile.yaml:1","Warn: no topLevel permission defined: .github/workflows/k8s-fuzzer.yaml:1","Warn: no topLevel permission defined: .github/workflows/k8s-sql-correctness.yaml:1","Warn: no topLevel permission defined: .github/workflows/label-customer-issues.yaml:1","Warn: no topLevel permission defined: .github/workflows/merge-perf-pr.yaml:1","Warn: no topLevel permission defined: .github/workflows/merge-perf.yaml:1","Warn: no topLevel permission defined: .github/workflows/nightly-performance-benchmarks-email-report.yaml:1","Warn: no topLevel permission defined: .github/workflows/performance-benchmarks-email-report.yaml:1","Warn: no topLevel permission defined: .github/workflows/performance-benchmarks-pull-report.yaml:1","Warn: no topLevel permission defined: .github/workflows/pull-report.yaml:1","Warn: no topLevel permission defined: .github/workflows/sql-correctness.yaml:1","Warn: no topLevel permission defined: .github/workflows/sql-regressions.yaml:1","Warn: no topLevel permission defined: .github/workflows/sysbench-benchmarks-pull-report.yaml:1","Warn: no topLevel permission defined: .github/workflows/sysbench-perf.yaml:1","Warn: no topLevel permission defined: .github/workflows/sysbench-performance.yaml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#token-permissions"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#fuzzing"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#binary-artifacts"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v1.88.2 not signed: https://api.github.com/repos/dolthub/dolt/releases/371878384","Warn: release artifact v2.3.0 not signed: https://api.github.com/repos/dolthub/dolt/releases/370129273","Warn: release artifact v2.2.4 not signed: https://api.github.com/repos/dolthub/dolt/releases/369577979","Warn: release artifact v2.2.3 not signed: https://api.github.com/repos/dolthub/dolt/releases/362122133","Warn: release artifact v2.2.2 not signed: https://api.github.com/repos/dolthub/dolt/releases/357707707","Warn: release artifact v1.88.2 does not have provenance: https://api.github.com/repos/dolthub/dolt/releases/371878384","Warn: release artifact v2.3.0 does not have provenance: https://api.github.com/repos/dolthub/dolt/releases/370129273","Warn: release artifact v2.2.4 does not have provenance: https://api.github.com/repos/dolthub/dolt/releases/369577979","Warn: release artifact v2.2.3 does not have provenance: https://api.github.com/repos/dolthub/dolt/releases/362122133","Warn: release artifact v2.2.2 does not have provenance: https://api.github.com/repos/dolthub/dolt/releases/357707707"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#signed-releases"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/cd-push-docker-image.yaml:35"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#packaging"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 28 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#sast"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bump-dependency.yaml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/bump-dependency.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bump-dependency.yaml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/bump-dependency.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bump-dependency.yaml:98: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/bump-dependency.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bump-dependency.yaml:102: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/bump-dependency.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/bump-dependency.yaml:139: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/bump-dependency.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bump-dependency.yaml:161: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/bump-dependency.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cd-create-release-notes.yaml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-create-release-notes.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cd-create-release-notes.yaml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-create-release-notes.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:81: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:241: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:252: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:94: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:111: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:122: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:132: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:142: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:152: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:162: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:172: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:182: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:193: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:204: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:218: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cd-release.yaml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release.yaml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-bats-macos.yaml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-macos.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-macos.yaml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-macos.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-macos.yaml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-macos.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-macos.yaml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-macos.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-macos.yaml:114: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-macos.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-bats-macos.yaml:116: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-macos.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-unix-remote.yaml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix-remote.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-unix-remote.yaml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix-remote.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-unix-remote.yaml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix-remote.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-bats-unix.yaml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-unix.yaml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-unix.yaml:65: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-unix.yaml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:88: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:95: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:102: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:105: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:107: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:149: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:151: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-benchmark-runner-tests.yaml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-benchmark-runner-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-binlog-tests.yaml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-binlog-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-binlog-tests.yaml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-binlog-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-check-correctness.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-correctness.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-check-performance.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-performance.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:83: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:87: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:97: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:104: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:112: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:116: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:151: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-compatibility-tests.yaml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-compatibility-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-compatibility-tests.yaml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-compatibility-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-data-dump-loading-tests.yaml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-data-dump-loading-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-go-race-tests.yaml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-go-race-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-go-tests.yaml:82: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-go-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-go-tests.yaml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-go-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-lambdabats-unix.yaml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-lambdabats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-lambdabats-unix.yaml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-lambdabats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-lambdabats-unix.yaml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-lambdabats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-mysql-client-tests.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-mysql-client-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-mysql-client-tests.yaml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-mysql-client-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-mysql-client-tests.yaml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-mysql-client-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-mysql-client-tests.yaml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-mysql-client-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-orm-tests.yaml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-orm-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-orm-tests.yaml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-orm-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-orm-tests.yaml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-orm-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-orm-tests.yaml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-orm-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-sql-server-integration-tests.yaml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-sql-server-integration-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/doltgres-dependency.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/doltgres-dependency.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/doltgres-dependency.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/doltgres-dependency.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/doltgres-dependency.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/doltgres-dependency.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/doltgres-dependency.yml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/doltgres-dependency.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/email-report.yaml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/email-report.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/email-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/import-benchmarks-pull-report.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-benchmarks-pull-report.yaml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-benchmarks-pull-report.yaml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-benchmarks-pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/import-benchmarks-pull-report.yaml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-benchmarks-pull-report.yaml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-benchmarks-pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/import-perf.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-perf.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/import-perf.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-perf.yaml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-perf.yaml:137: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-perf.yaml:156: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-perf.yaml:162: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-perf.yaml:167: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-perf.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/k8s-benchmark-latency.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-benchmark-latency.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-benchmark-latency.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-benchmark-latency.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-benchmark-latency.yaml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-benchmark-latency.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/k8s-dolt-profile.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-dolt-profile.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-dolt-profile.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-dolt-profile.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-dolt-profile.yaml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-dolt-profile.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/k8s-fuzzer.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-fuzzer.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-fuzzer.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-fuzzer.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-fuzzer.yaml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-fuzzer.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/k8s-sql-correctness.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-sql-correctness.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-sql-correctness.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-sql-correctness.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-sql-correctness.yaml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-sql-correctness.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/label-customer-issues.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/label-customer-issues.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/merge-perf-pr.yaml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf-pr.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/merge-perf-pr.yaml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf-pr.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/merge-perf-pr.yaml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf-pr.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/merge-perf-pr.yaml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf-pr.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/merge-perf-pr.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf-pr.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/merge-perf.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/merge-perf.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/merge-perf.yaml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/merge-perf.yaml:167: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/merge-perf.yaml:186: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/merge-perf.yaml:192: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/merge-perf.yaml:197: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nightly-performance-benchmarks-email-report.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/nightly-performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nightly-performance-benchmarks-email-report.yaml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/nightly-performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nightly-performance-benchmarks-email-report.yaml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/nightly-performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nightly-performance-benchmarks-email-report.yaml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/nightly-performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nightly-performance-benchmarks-email-report.yaml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/nightly-performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nightly-performance-benchmarks-email-report.yaml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/nightly-performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-email-report.yaml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-email-report.yaml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-email-report.yaml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-email-report.yaml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-email-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-pull-report.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-pull-report.yaml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-pull-report.yaml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-pull-report.yaml:65: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-pull-report.yaml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-pull-report.yaml:75: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:103: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:141: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:181: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:219: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:265: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:287: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sql-correctness.yaml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sql-correctness.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sql-regressions.yaml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sql-regressions.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sql-regressions.yaml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sql-regressions.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sql-regressions.yaml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sql-regressions.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sql-regressions.yaml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sql-regressions.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sysbench-benchmarks-pull-report.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-benchmarks-pull-report.yaml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-benchmarks-pull-report.yaml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-benchmarks-pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sysbench-benchmarks-pull-report.yaml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-benchmarks-pull-report.yaml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-benchmarks-pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sysbench-perf.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-perf.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sysbench-perf.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-perf.yaml:138: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-perf.yaml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-perf.yaml:163: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-perf.yaml:168: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-perf.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sysbench-performance.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-performance.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-performance.yaml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-performance.yaml/main?enable=pin","Warn: containerImage not pinned by hash: docker/Dockerfile:2: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:2edbbc5dc405e9612ba3584ce95480277e3eb374407b5505fe26f17df77c7dbc","Warn: containerImage not pinned by hash: docker/serverDockerfile:3: pin your Docker image by updating debian:bookworm-slim to debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241","Warn: containerImage not pinned by hash: docker/serverDockerfile:12: pin your Docker image by updating golang:1.26.2-bookworm to golang:1.26.2-bookworm@sha256:47ce5636e9936b2c5cbf708925578ef386b4f8872aec74a67bd13a627d242b19","Warn: containerImage not pinned by hash: docker/serverDockerfile:42","Warn: containerImage not pinned by hash: docker/serverDockerfile:56","Warn: containerImage not pinned by hash: go/performance/continuous_integration/SysbenchDockerfile:2: pin your Docker image by updating golang:1.23.3-alpine to golang:1.23.3-alpine@sha256:c694a4d291a13a9f9d94933395673494fc2cc9d4777b85df3a7e70b3492d3574","Warn: containerImage not pinned by hash: go/performance/continuous_integration/SysbenchDockerfile:3: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:2edbbc5dc405e9612ba3584ce95480277e3eb374407b5505fe26f17df77c7dbc","Warn: containerImage not pinned by hash: integration-tests/DataDumpLoadDockerfile:1: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:2edbbc5dc405e9612ba3584ce95480277e3eb374407b5505fe26f17df77c7dbc","Warn: containerImage not pinned by hash: integration-tests/bats/tzdataDockerfile:2: pin your Docker image by updating golang:1.26.2-trixie to golang:1.26.2-trixie@sha256:4a7137ea573f79c86ae451ff05817ed762ef5597fcf732259e97abeb3108d873","Warn: containerImage not pinned by hash: integration-tests/bats/tzdataDockerfile:10: pin your Docker image by updating golang:1.26.2-trixie to golang:1.26.2-trixie@sha256:4a7137ea573f79c86ae451ff05817ed762ef5597fcf732259e97abeb3108d873","Warn: containerImage not pinned by hash: integration-tests/bats/tzdataDockerfile:20: pin your Docker image by updating debian:bookworm-slim to debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:2: pin your Docker image by updating golang:1.26.2-alpine to golang:1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:7","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:15","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:24: pin your Docker image by updating rust:1.90-alpine3.22 to rust:1.90-alpine3.22@sha256:b4b54b176a74db7e5c68fdfe6029be39a02ccbcfe72b6e5a3e18e2c61b57ae26","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:30: pin your Docker image by updating debian:bookworm-slim to debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:49: pin your Docker image by updating debian:bookworm-slim to debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:64: pin your Docker image by updating debian:bookworm-slim to debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:73: pin your Docker image by updating python:3.14-slim-bookworm to python:3.14-slim-bookworm@sha256:23c59390fc717bf09f9336908199a0ae75d9c4264bf296123f94ad772fea3b52","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:85: pin your Docker image by updating elixir:1.18.3-slim to elixir:1.18.3-slim@sha256:fc227cb4b0c568a1f7cf6a8e40269185248cd29204c0d4e95cdefe31f5d1a873","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:104: pin your Docker image by updating maven:3.8-openjdk-17-slim to maven:3.8-openjdk-17-slim@sha256:502e781d39f0b40fbd02eb23f5b7663618b76ba52034da218c64e92f6c5647be","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:116: pin your Docker image by updating node:22-bookworm-slim to node:22-bookworm-slim@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:122: pin your Docker image by updating ruby:3.4-bookworm to ruby:3.4-bookworm@sha256:56e0c9fdbf64d090e45072d32f0d3be7f2e392e733444f7d176a50881e6c325a","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:129: pin your Docker image by updating swift:5.10-bookworm to swift:5.10-bookworm@sha256:44841ece23d6770237f1d38b9a17ab26ccb296dcbb3c1e8b3e483a24f7d664f4","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:136: pin your Docker image by updating debian:bookworm-slim to debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:144: pin your Docker image by updating php:8.3-bookworm to php:8.3-bookworm@sha256:97bcc5ac3fce7ba7fb769b4709c9da2b64aef3a2685c8271c2c61b409d8fa74e","Warn: containerImage not pinned by hash: integration-tests/orm-tests/Dockerfile:2: pin your Docker image by updating golang:1.26.2-alpine to golang:1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1","Warn: containerImage not pinned by hash: integration-tests/orm-tests/Dockerfile:7","Warn: containerImage not pinned by hash: integration-tests/orm-tests/Dockerfile:16: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:2edbbc5dc405e9612ba3584ce95480277e3eb374407b5505fe26f17df77c7dbc","Warn: downloadThenRun not pinned by hash: docker/Dockerfile:18","Warn: downloadThenRun not pinned by hash: docker/serverDockerfile:44-53","Warn: downloadThenRun not pinned by hash: go/performance/continuous_integration/SysbenchDockerfile:64","Warn: downloadThenRun not pinned by hash: integration-tests/DataDumpLoadDockerfile:5-20","Warn: downloadThenRun not pinned by hash: integration-tests/bats/tzdataDockerfile:6","Warn: nugetCommand not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:38: pin your dependencies by either enabling central package management (https://learn.microsoft.com/nuget/consume-packages/Central-Package-Management) or using a lockfile (https://learn.microsoft.com/nuget/consume-packages/package-references-in-project-files#locking-dependencies)","Warn: nugetCommand not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:44: pin your dependencies by either enabling central package management (https://learn.microsoft.com/nuget/consume-packages/Central-Package-Management) or using a lockfile (https://learn.microsoft.com/nuget/consume-packages/package-references-in-project-files#locking-dependencies)","Warn: pipCommand not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:75","Warn: npmCommand not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:119","Warn: downloadThenRun not pinned by hash: integration-tests/orm-tests/Dockerfile:20-26","Warn: pipCommand not pinned by hash: integration-tests/orm-tests/Dockerfile:46","Warn: goCommand not pinned by hash: go/utils/repofmt/check_fmt.sh:8","Warn: npmCommand not pinned by hash: .github/workflows/ci-bats-macos.yaml:59","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-macos.yaml:64","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-macos.yaml:65","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-macos.yaml:66","Warn: npmCommand not pinned by hash: .github/workflows/ci-bats-unix-remote.yaml:50","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-unix-remote.yaml:56","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-unix-remote.yaml:57","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-unix-remote.yaml:58","Warn: npmCommand not pinned by hash: .github/workflows/ci-bats-unix.yaml:78","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-unix.yaml:83","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-unix.yaml:84","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-unix.yaml:85","Warn: chocoCommand not pinned by hash: .github/workflows/ci-bats-windows.yaml:123","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-windows.yaml:130","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-windows.yaml:131","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-windows.yaml:132","Warn: goCommand not pinned by hash: .github/workflows/ci-check-repo.yaml:112","Warn: npmCommand not pinned by hash: .github/workflows/ci-compatibility-tests.yaml:35","Warn: goCommand not pinned by hash: .github/workflows/ci-lambdabats-unix.yaml:54","Warn: goCommand not pinned by hash: .github/workflows/doltgres-dependency.yml:79","Warn: downloadThenRun not pinned by hash: .github/workflows/sysbench-perf.yaml:36","Info:   0 out of  87 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of  92 third-party GitHubAction dependencies pinned","Info:   0 out of  14 pipCommand dependencies pinned","Info:   0 out of   5 npmCommand dependencies pinned","Info:   0 out of   1 chocoCommand dependencies pinned","Info:   0 out of  29 containerImage dependencies pinned","Info:   0 out of   7 downloadThenRun dependencies pinned","Info:   4 out of   8 goCommand dependencies pinned","Info:   0 out of   2 nugetCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#pinned-dependencies"}}]}