fix(scorecard): share validated action-lock audit semantics

[hyperpolymath]

The local Scorecard ingestor still used a tag-only regex after the workflow auditor gained strict action-lock validation. This produced a contradictory DependencyPinning finding for Gossamer despite authoritative lock verification passing. Route the ingestor through the existing WorkflowAudit implementation; malformed locks, wrong workflow associations and wrong refs remain findings. No baseline suppression or gate threshold is changed. Six focused ExUnit tests pass, including missing/malformed lock, wrong workflow/ref and unpinned sub-action branch controls. Formatting and git diff checks pass. Full upstream CI and protected merge remain required; no production-beta qualification is claimed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: fbd1d000-528e-4d52-ba87-9549cc0cd2e2

📥 Commits

Reviewing files that changed from the base of the PR and between 0e91342 and 1439d8d.

📒 Files selected for processing (2)

• lib/scorecard_ingestor.ex
• test/scorecard_ingestor_actions_lock_test.exs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Improved GitHub Actions dependency-pinning checks using workflow files and optional lock files.
  • Added detection for unpinned branch-based actions and mismatches between workflows and lock files.
  • Missing lock files are handled gracefully, while other lock-file read errors are reported.

Walkthrough

The Scorecard ingestor now validates GitHub Actions pinning through WorkflowAudit and an optional actions.lock file. Tests cover valid, missing, malformed, mismatched, and branch-based action references.

Changes

Actions lock validation

Layer / File(s)	Summary
Workflow audit integration lib/scorecard_ingestor.ex, test/scorecard_ingestor_actions_lock_test.exs	check_pinned_dependencies reads workflow files and actions.lock, delegates validation to WorkflowAudit, filters :pin_exempt_accepted, and reports remaining SC-013 findings. Tests cover lock and reference validation cases.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 1439d

Scorecard dependency-pinning findings now use strict workflow-lock validation, improving detection while avoiding contradictory findings for valid locks. The covered behavior is ready to merge.

Sequence Diagram(s)

sequenceDiagram
  participant ScorecardIngestor
  participant WorkflowFiles
  participant ActionsLock
  participant WorkflowAudit
  ScorecardIngestor->>WorkflowFiles: Read workflow contents
  ScorecardIngestor->>ActionsLock: Read optional actions.lock
  ScorecardIngestor->>WorkflowAudit: Call check_unpinned_actions
  WorkflowAudit-->>ScorecardIngestor: Return pinning findings
  ScorecardIngestor->>ScorecardIngestor: Filter :pin_exempt_accepted
  ScorecardIngestor-->>ScorecardIngestor: Emit SC-013 for remaining findings

Loading

Poem

A rabbit checks each action pin,
With locks and workflows neatly in.
Branches hop into the audit light,
Exemptions rest, while faults take flight.
SC-013 thumps a careful beat,
And every test makes checks complete.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarises the main change: it updates the Scorecard ingestor to use shared, validated action-lock audit semantics.
Description check	✅ Passed	The description directly explains the changeset, retained findings, test coverage, and scope limits.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}