Merge pull request #530 from slashdevops/fix/openssf-action-sha-dereference

fix(ci): pin scorecard-action and codecov to commit SHAs (not tag-object SHAs)

Author: christiangda

.github/workflows/build.yml

@@ -39,7 +39,7 @@ jobs:
         run: make test
 
       - name: codecov coverage report
-        uses: codecov/codecov-action@aa56896cf108bd10b5eb883cd1d24196da57f695  # v5.5.4
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe  # v5.5.4
         with:
           files: ./coverage.out
 

.github/workflows/scorecard.yml

@@ -25,7 +25,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@99c09fe975337306107572b4fdf4db224cf8e2f2  # v2.4.3
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a  # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif