{"date":"2026-10-12","repo":{"name":"github.com/dolthub/dolt","commit":"3e8f48209dd24ea8ee561373f129b6c48a8c1102"},"scorecard":{"version":"v5.6.0","commit":"61e84743356275f6ffca23b1b2f2cb945e19eb96"},"score":5.7,"checks":[{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#code-review","short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged."}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#maintained","short":"Determines if the project is \"actively maintained\"."}},{"name":"Security-Policy","score":9,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#security-policy","short":"Determines if the project has published a security policy."}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#dangerous-workflow","short":"Determines if the project's GitHub Action workflows avoid dangerous patterns."}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#binary-artifacts","short":"Determines if the project has generated executable (binary) artifacts in the source repository."}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: jobLevel 'actions' permission set to 'write': .github/workflows/ci-check-correctness.yaml:12","Info: jobLevel 'contents' permission set to 'read': .github/workflows/ci-check-correctness.yaml:15","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/ci-check-performance.yaml:13","Info: jobLevel 'contents' permission set to 'read': .github/workflows/ci-check-performance.yaml:16","Info: jobLevel 'contents' permission set to 'read': .github/workflows/ci-scheduler.yaml:76","Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/ci-scheduler.yaml:77","Warn: jobLevel 'statuses' permission set to 'write': .github/workflows/ci-scheduler.yaml:117","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/ci-scheduler.yaml:118","Info: jobLevel 'contents' permission set to 'read': .github/workflows/ci-scheduler.yaml:113","Info: jobLevel 'contents' permission set to 'read': .github/workflows/ci-scheduler.yaml:53","Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/ci-scheduler.yaml:54","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/ci-scheduler.yaml:55","Warn: no topLevel permission defined: .github/workflows/bump-dependency.yaml:1","Warn: no topLevel permission defined: .github/workflows/cd-bump-winget.yaml:1","Warn: no topLevel permission defined: .github/workflows/cd-create-release-notes.yaml:1","Warn: no topLevel permission defined: .github/workflows/cd-push-docker-image.yaml:1","Warn: no topLevel permission defined: .github/workflows/cd-release-pgo.yaml:1","Warn: no topLevel permission defined: .github/workflows/cd-release.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-bats-macos.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-bats-unix-remote.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-bats-unix.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-bats-windows.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-benchmark-runner-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-binlog-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-check-correctness.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-check-performance.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-check-repo.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-compatibility-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-data-dump-loading-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-go-race-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-go-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-lambdabats-unix.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-mysql-client-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/ci-orm-tests.yaml:1","Info: found token with 'none' permissions: .github/workflows/ci-review-notification.yaml:1","Info: found token with 'none' permissions: .github/workflows/ci-scheduler.yaml:1","Warn: topLevel 'actions' permission set to 'write': .github/workflows/ci-scheduling-tests.yaml:10","Info: topLevel 'contents' permission set to 'read': .github/workflows/ci-scheduling-tests.yaml:11","Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/ci-scheduling-tests.yaml:12","Warn: no topLevel permission defined: .github/workflows/ci-sql-server-integration-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/doltgres-dependency.yml:1","Warn: no topLevel permission defined: .github/workflows/email-report.yaml:1","Warn: no topLevel permission defined: .github/workflows/import-benchmarks-pull-report.yaml:1","Warn: no topLevel permission defined: .github/workflows/import-perf.yaml:1","Warn: no topLevel permission defined: .github/workflows/k8s-benchmark-latency.yaml:1","Warn: no topLevel permission defined: .github/workflows/k8s-dolt-profile.yaml:1","Warn: no topLevel permission defined: .github/workflows/k8s-fuzzer.yaml:1","Warn: no topLevel permission defined: .github/workflows/k8s-sql-correctness.yaml:1","Warn: no topLevel permission defined: .github/workflows/label-customer-issues.yaml:1","Warn: no topLevel permission defined: .github/workflows/merge-perf-pr.yaml:1","Warn: no topLevel permission defined: .github/workflows/merge-perf.yaml:1","Warn: no topLevel permission defined: .github/workflows/nightly-performance-benchmarks-email-report.yaml:1","Warn: no topLevel permission defined: .github/workflows/performance-benchmarks-email-report.yaml:1","Warn: no topLevel permission defined: .github/workflows/performance-benchmarks-pull-report.yaml:1","Warn: no topLevel permission defined: .github/workflows/pull-report.yaml:1","Warn: no topLevel permission defined: .github/workflows/sql-correctness.yaml:1","Warn: no topLevel permission defined: .github/workflows/sql-regressions.yaml:1","Warn: no topLevel permission defined: .github/workflows/sysbench-benchmarks-pull-report.yaml:1","Warn: no topLevel permission defined: .github/workflows/sysbench-perf.yaml:1","Warn: no topLevel permission defined: .github/workflows/sysbench-performance.yaml:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#token-permissions","short":"Determines if the project's workflows follow the principle of least privilege."}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#cii-best-practices","short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge."}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#license","short":"Determines if the project has defined a license."}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#fuzzing","short":"Determines if the project uses fuzzing."}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#branch-protection","short":"Determines if the default and release branches are protected with GitHub's branch protection settings."}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v2.4.2 not signed: https://api.github.com/repos/dolthub/dolt/releases/404938241","Warn: release artifact v2.4.1 not signed: https://api.github.com/repos/dolthub/dolt/releases/402228900","Warn: release artifact v2.4.0 not signed: https://api.github.com/repos/dolthub/dolt/releases/399640829","Warn: release artifact v2.3.5 not signed: https://api.github.com/repos/dolthub/dolt/releases/390084095","Warn: release artifact v2.3.4 not signed: https://api.github.com/repos/dolthub/dolt/releases/388702733","Warn: release artifact v2.4.2 does not have provenance: https://api.github.com/repos/dolthub/dolt/releases/404938241","Warn: release artifact v2.4.1 does not have provenance: https://api.github.com/repos/dolthub/dolt/releases/402228900","Warn: release artifact v2.4.0 does not have provenance: https://api.github.com/repos/dolthub/dolt/releases/399640829","Warn: release artifact v2.3.5 does not have provenance: https://api.github.com/repos/dolthub/dolt/releases/390084095","Warn: release artifact v2.3.4 does not have provenance: https://api.github.com/repos/dolthub/dolt/releases/388702733"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#signed-releases","short":"Determines if the project cryptographically signs release artifacts."}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/cd-push-docker-image.yaml:35"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#packaging","short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall."}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#sast","short":"Determines if the project uses static code analysis."}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bump-dependency.yaml:98: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/bump-dependency.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bump-dependency.yaml:102: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/bump-dependency.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/bump-dependency.yaml:139: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/bump-dependency.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bump-dependency.yaml:161: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/bump-dependency.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bump-dependency.yaml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/bump-dependency.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bump-dependency.yaml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/bump-dependency.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cd-create-release-notes.yaml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-create-release-notes.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cd-create-release-notes.yaml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-create-release-notes.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-push-docker-image.yaml:81: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-push-docker-image.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:241: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:252: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:111: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:122: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:132: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:142: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:152: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:162: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:172: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:182: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:193: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:204: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release-pgo.yaml:218: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release-pgo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cd-release.yaml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cd-release.yaml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/cd-release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-macos.yaml:114: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-macos.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-bats-macos.yaml:116: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-macos.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-bats-macos.yaml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-macos.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-macos.yaml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-macos.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-macos.yaml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-macos.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-macos.yaml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-macos.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-unix-remote.yaml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix-remote.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-unix-remote.yaml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix-remote.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-unix-remote.yaml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix-remote.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-bats-unix.yaml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-unix.yaml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-unix.yaml:78: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-unix.yaml:99: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-unix.yaml:114: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-unix.yaml:128: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:88: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:95: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:102: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:105: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:107: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:149: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-bats-windows.yaml:151: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-bats-windows.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-benchmark-runner-tests.yaml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-benchmark-runner-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-binlog-tests.yaml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-binlog-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-binlog-tests.yaml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-binlog-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-check-correctness.yaml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-correctness.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-check-performance.yaml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-performance.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:109: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:116: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:124: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:128: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:82: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:91: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-check-repo.yaml:95: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-check-repo.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-compatibility-tests.yaml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-compatibility-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-compatibility-tests.yaml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-compatibility-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-data-dump-loading-tests.yaml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-data-dump-loading-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-go-race-tests.yaml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-go-race-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-go-tests.yaml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-go-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-go-tests.yaml:90: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-go-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-lambdabats-unix.yaml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-lambdabats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-lambdabats-unix.yaml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-lambdabats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-lambdabats-unix.yaml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-lambdabats-unix.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-mysql-client-tests.yaml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-mysql-client-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-mysql-client-tests.yaml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-mysql-client-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-mysql-client-tests.yaml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-mysql-client-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-mysql-client-tests.yaml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-mysql-client-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-orm-tests.yaml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-orm-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-orm-tests.yaml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-orm-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-orm-tests.yaml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-orm-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-orm-tests.yaml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-orm-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-scheduler.yaml:120: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-scheduler.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-scheduler.yaml:125: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-scheduler.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-scheduler.yaml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-scheduler.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-scheduler.yaml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-scheduler.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-scheduler.yaml:82: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-scheduler.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-scheduler.yaml:88: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-scheduler.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-scheduling-tests.yaml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-scheduling-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-scheduling-tests.yaml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-scheduling-tests.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-sql-server-integration-tests.yaml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/ci-sql-server-integration-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/doltgres-dependency.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/doltgres-dependency.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/doltgres-dependency.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/doltgres-dependency.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/doltgres-dependency.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/doltgres-dependency.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/doltgres-dependency.yml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/doltgres-dependency.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/email-report.yaml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/email-report.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/email-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/import-benchmarks-pull-report.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-benchmarks-pull-report.yaml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-benchmarks-pull-report.yaml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-benchmarks-pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/import-benchmarks-pull-report.yaml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-benchmarks-pull-report.yaml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-benchmarks-pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/import-perf.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-perf.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/import-perf.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-perf.yaml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-perf.yaml:137: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-perf.yaml:156: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-perf.yaml:162: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/import-perf.yaml:167: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/import-perf.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/k8s-benchmark-latency.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-benchmark-latency.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-benchmark-latency.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-benchmark-latency.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-benchmark-latency.yaml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-benchmark-latency.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/k8s-dolt-profile.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-dolt-profile.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-dolt-profile.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-dolt-profile.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-dolt-profile.yaml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-dolt-profile.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/k8s-fuzzer.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-fuzzer.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-fuzzer.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-fuzzer.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-fuzzer.yaml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-fuzzer.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/k8s-sql-correctness.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-sql-correctness.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-sql-correctness.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-sql-correctness.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/k8s-sql-correctness.yaml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/k8s-sql-correctness.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/label-customer-issues.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/label-customer-issues.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/merge-perf-pr.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf-pr.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/merge-perf-pr.yaml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf-pr.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/merge-perf-pr.yaml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf-pr.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/merge-perf-pr.yaml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf-pr.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/merge-perf-pr.yaml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf-pr.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/merge-perf.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/merge-perf.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/merge-perf.yaml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/merge-perf.yaml:167: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/merge-perf.yaml:186: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/merge-perf.yaml:192: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/merge-perf.yaml:197: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/merge-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nightly-performance-benchmarks-email-report.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/nightly-performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nightly-performance-benchmarks-email-report.yaml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/nightly-performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nightly-performance-benchmarks-email-report.yaml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/nightly-performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nightly-performance-benchmarks-email-report.yaml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/nightly-performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nightly-performance-benchmarks-email-report.yaml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/nightly-performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nightly-performance-benchmarks-email-report.yaml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/nightly-performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-email-report.yaml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-email-report.yaml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-email-report.yaml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-email-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-email-report.yaml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-email-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-pull-report.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-pull-report.yaml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-pull-report.yaml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-pull-report.yaml:77: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-pull-report.yaml:82: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/performance-benchmarks-pull-report.yaml:87: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/performance-benchmarks-pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:103: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:141: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:181: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:219: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-report.yaml:265: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sql-correctness.yaml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sql-correctness.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sql-regressions.yaml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sql-regressions.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sql-regressions.yaml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sql-regressions.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sql-regressions.yaml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sql-regressions.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sql-regressions.yaml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sql-regressions.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-benchmarks-pull-report.yaml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-benchmarks-pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sysbench-benchmarks-pull-report.yaml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-benchmarks-pull-report.yaml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-benchmarks-pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sysbench-benchmarks-pull-report.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-benchmarks-pull-report.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-benchmarks-pull-report.yaml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-benchmarks-pull-report.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sysbench-perf.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-perf.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sysbench-perf.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-perf.yaml:138: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-perf.yaml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-perf.yaml:163: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-perf.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-perf.yaml:168: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-perf.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sysbench-performance.yaml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-performance.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sysbench-performance.yaml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/dolthub/dolt/sysbench-performance.yaml/main?enable=pin","Warn: containerImage not pinned by hash: docker/Dockerfile:2: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:5ec03bb3441e8b0bf3b4f9cd4629a1ae763010dc3035bb8da3ae6cf026486401","Warn: containerImage not pinned by hash: docker/serverDockerfile:3: pin your Docker image by updating debian:bookworm-slim to debian:bookworm-slim@sha256:7c7b2c966bc9ee8cedfeef67e0e279108992c77681fa595db4a9d65c06ccc587","Warn: containerImage not pinned by hash: docker/serverDockerfile:12: pin your Docker image by updating golang:1.26.2-bookworm to golang:1.26.2-bookworm@sha256:47ce5636e9936b2c5cbf708925578ef386b4f8872aec74a67bd13a627d242b19","Warn: containerImage not pinned by hash: docker/serverDockerfile:42","Warn: containerImage not pinned by hash: docker/serverDockerfile:56","Warn: containerImage not pinned by hash: go/performance/continuous_integration/SysbenchDockerfile:2: pin your Docker image by updating golang:1.23.3-alpine to golang:1.23.3-alpine@sha256:c694a4d291a13a9f9d94933395673494fc2cc9d4777b85df3a7e70b3492d3574","Warn: containerImage not pinned by hash: go/performance/continuous_integration/SysbenchDockerfile:3: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:5ec03bb3441e8b0bf3b4f9cd4629a1ae763010dc3035bb8da3ae6cf026486401","Warn: containerImage not pinned by hash: integration-tests/DataDumpLoadDockerfile:1: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:5ec03bb3441e8b0bf3b4f9cd4629a1ae763010dc3035bb8da3ae6cf026486401","Warn: containerImage not pinned by hash: integration-tests/bats/tzdataDockerfile:2: pin your Docker image by updating golang:1.26.2-trixie to golang:1.26.2-trixie@sha256:4a7137ea573f79c86ae451ff05817ed762ef5597fcf732259e97abeb3108d873","Warn: containerImage not pinned by hash: integration-tests/bats/tzdataDockerfile:10: pin your Docker image by updating golang:1.26.2-trixie to golang:1.26.2-trixie@sha256:4a7137ea573f79c86ae451ff05817ed762ef5597fcf732259e97abeb3108d873","Warn: containerImage not pinned by hash: integration-tests/bats/tzdataDockerfile:20: pin your Docker image by updating debian:bookworm-slim to debian:bookworm-slim@sha256:7c7b2c966bc9ee8cedfeef67e0e279108992c77681fa595db4a9d65c06ccc587","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:2: pin your Docker image by updating golang:1.26.2-alpine to golang:1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:7","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:15","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:24: pin your Docker image by updating rust:1.90-alpine3.22 to rust:1.90-alpine3.22@sha256:b4b54b176a74db7e5c68fdfe6029be39a02ccbcfe72b6e5a3e18e2c61b57ae26","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:30: pin your Docker image by updating debian:bookworm-slim to debian:bookworm-slim@sha256:7c7b2c966bc9ee8cedfeef67e0e279108992c77681fa595db4a9d65c06ccc587","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:49: pin your Docker image by updating debian:bookworm-slim to debian:bookworm-slim@sha256:7c7b2c966bc9ee8cedfeef67e0e279108992c77681fa595db4a9d65c06ccc587","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:64: pin your Docker image by updating debian:bookworm-slim to debian:bookworm-slim@sha256:7c7b2c966bc9ee8cedfeef67e0e279108992c77681fa595db4a9d65c06ccc587","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:73: pin your Docker image by updating python:3.14-slim-bookworm to python:3.14-slim-bookworm@sha256:48b13b003dda20b16f9442b8475aa05fe21bf6579a8c881db92ffb4d8fd20f83","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:86: pin your Docker image by updating elixir:1.18.3-slim to elixir:1.18.3-slim@sha256:fc227cb4b0c568a1f7cf6a8e40269185248cd29204c0d4e95cdefe31f5d1a873","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:105: pin your Docker image by updating maven:3.9-eclipse-temurin-17-noble to maven:3.9-eclipse-temurin-17-noble@sha256:1a352420f7aba21f5ad08df31bab55f74c013fb491f1ae8ab1dd7ff9ed698584","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:117: pin your Docker image by updating node:22-bookworm-slim to node:22-bookworm-slim@sha256:c3de60bf2f9dd0ac6370e6117950ff62d6e339527e7472301c9c78a017978392","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:123: pin your Docker image by updating ruby:3.4-bookworm to ruby:3.4-bookworm@sha256:80259ba83f866aaa43c689e11569dc950b2e508effca0799d50608f7c4ca6172","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:130: pin your Docker image by updating swift:5.10-bookworm to swift:5.10-bookworm@sha256:44841ece23d6770237f1d38b9a17ab26ccb296dcbb3c1e8b3e483a24f7d664f4","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:137: pin your Docker image by updating debian:bookworm-slim to debian:bookworm-slim@sha256:7c7b2c966bc9ee8cedfeef67e0e279108992c77681fa595db4a9d65c06ccc587","Warn: containerImage not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:145: pin your Docker image by updating php:8.3-bookworm to php:8.3-bookworm@sha256:c24b55afdf860c874b9ec6267ced132ff52de97d308ab08e6cf41e8596e509f7","Warn: containerImage not pinned by hash: integration-tests/orm-tests/Dockerfile:2: pin your Docker image by updating golang:1.26.2-alpine to golang:1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1","Warn: containerImage not pinned by hash: integration-tests/orm-tests/Dockerfile:7","Warn: containerImage not pinned by hash: integration-tests/orm-tests/Dockerfile:16: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:5ec03bb3441e8b0bf3b4f9cd4629a1ae763010dc3035bb8da3ae6cf026486401","Warn: downloadThenRun not pinned by hash: docker/Dockerfile:18","Warn: downloadThenRun not pinned by hash: docker/serverDockerfile:44-53","Warn: downloadThenRun not pinned by hash: go/performance/continuous_integration/SysbenchDockerfile:64","Warn: downloadThenRun not pinned by hash: integration-tests/DataDumpLoadDockerfile:5-20","Warn: downloadThenRun not pinned by hash: integration-tests/bats/tzdataDockerfile:6","Warn: nugetCommand not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:38: pin your dependencies by either enabling central package management (https://learn.microsoft.com/nuget/consume-packages/Central-Package-Management) or using a lockfile (https://learn.microsoft.com/nuget/consume-packages/package-references-in-project-files#locking-dependencies)","Warn: nugetCommand not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:44: pin your dependencies by either enabling central package management (https://learn.microsoft.com/nuget/consume-packages/Central-Package-Management) or using a lockfile (https://learn.microsoft.com/nuget/consume-packages/package-references-in-project-files#locking-dependencies)","Warn: pipCommand not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:75","Warn: npmCommand not pinned by hash: integration-tests/mysql-client-tests/Dockerfile:120","Warn: downloadThenRun not pinned by hash: integration-tests/orm-tests/Dockerfile:20-26","Warn: pipCommand not pinned by hash: integration-tests/orm-tests/Dockerfile:46","Warn: goCommand not pinned by hash: go/utils/repofmt/check_fmt.sh:8","Warn: npmCommand not pinned by hash: .github/workflows/ci-bats-macos.yaml:59","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-macos.yaml:64","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-macos.yaml:65","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-macos.yaml:66","Warn: npmCommand not pinned by hash: .github/workflows/ci-bats-unix-remote.yaml:54","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-unix-remote.yaml:60","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-unix-remote.yaml:61","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-unix-remote.yaml:62","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-unix.yaml:93","Warn: chocoCommand not pinned by hash: .github/workflows/ci-bats-windows.yaml:123","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-windows.yaml:130","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-windows.yaml:131","Warn: pipCommand not pinned by hash: .github/workflows/ci-bats-windows.yaml:132","Warn: goCommand not pinned by hash: .github/workflows/ci-check-repo.yaml:124","Warn: npmCommand not pinned by hash: .github/workflows/ci-compatibility-tests.yaml:39","Warn: goCommand not pinned by hash: .github/workflows/ci-lambdabats-unix.yaml:58","Warn: goCommand not pinned by hash: .github/workflows/doltgres-dependency.yml:83","Warn: downloadThenRun not pinned by hash: .github/workflows/sysbench-perf.yaml:36","Info:   0 out of  97 GitHub-owned GitHubAction dependencies pinned","Info:   3 out of  92 third-party GitHubAction dependencies pinned","Info:   0 out of  29 containerImage dependencies pinned","Info:   0 out of   7 downloadThenRun dependencies pinned","Info:   4 out of   8 goCommand dependencies pinned","Info:   0 out of   2 nugetCommand dependencies pinned","Info:   0 out of  12 pipCommand dependencies pinned","Info:   1 out of   5 npmCommand dependencies pinned","Info:   0 out of   1 chocoCommand dependencies pinned"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#pinned-dependencies","short":"Determines if the project has declared and pinned the dependencies of its build process."}}]}