To fix Scorecard's Token-Permissions check, set the top level permissions in each workflow to read-only and grant write access per job. To fix Pinned-Dependencies, pin Dockerfile, script and workflow dependencies to hashes or exact versions, and commit lock files. Both can be done in one pull request.
Token-Permissions
The checks documentation says this check passes when the workflow GITHUB_TOKEN permissions are read-only at the top level, with write permissions granted only for the jobs that need them. It is rated High.
Add a block at the top of each workflow file.
permissions:
contents: read
jobs:
release:
permissions:
contents: write
id-token: write
runs-on: ubuntu-latest
Everything not listed gets no access. Go through each job and ask what it really needs. Test jobs almost never need write access. A release job might need contents write, and a job that publishes with OIDC needs id-token write.
Pinned-Dependencies
This check, rated Medium, looks at dependencies used in build and release: Dockerfiles, shell scripts and workflows. It wants them pinned to specific hashes or versions. The Scorecard FAQ recommends hash pinning over version pinning.
Where to look:
- Workflow actions: reference third party actions by full commit SHA, with a comment noting the version.
- Dockerfiles: pin base images by digest, not by a moving tag.
- Shell scripts: avoid piping a download straight into a shell, and verify checksums for downloaded tools.
- Package installs: commit lock files and install from them.
- uses: actions/checkout@<full-commit-sha> # v4
Keep pins from going stale
A pinned dependency stops getting fixes unless something updates it. The FAQ suggests pairing pinning with a dependency update tool such as Dependabot. The Dependency-Update-Tool check, rated High, only verifies that Dependabot or Renovate is configured. It does not check that the tool runs or that its pull requests get merged, so that part is on you.
Verify the fix
Run the Scorecard CLI on your repository with the show-details flag. The output lists each unpinned or over-permissioned item, which makes a good to-do list. Rerun after merging to confirm both checks improved.
Trade-offs
Pinning by hash makes builds reproducible and blocks silent upstream changes. It also adds review work for each update. Automated update pull requests with a required review keep that cost low.
If you want policy enforcement beyond Scorecard, Safeguard policies and gates can check pull requests for unpinned references before they merge.
Quick check
Do I need to pin first party actions?
Scorecard's check is about build dependencies in general. Pinning every action by SHA is the safest approach to satisfy it.
Sources
Last reviewed: 19 October 2026.
