ci: enforce Pinned-Dependencies check in CI for PRs

.github/workflows/scorecard.yml

@@ -16,11 +16,14 @@ on:
   # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
   branch_protection_rule:
   # To guarantee Maintained check is occasionally updated. See
-  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintaineds
   schedule:
-    - cron: '29 15 * * 6'
+    - cron: "29 15 * * 6"
   push:
-    branches: [ "main" ]
+    branches: ["main"]
+  # Add pull_request trigger to check PRs
+  pull_request:
+    branches: ["main"]
 
 # Declare default permissions as read only.
 permissions: read-all
@@ -32,7 +35,7 @@ jobs:
     permissions:
       # Needed to upload the results to code-scanning dashboard.
       security-events: write
-      # Needed to publish results and get a badge (see publish_results below).
+      # Needed to publish results and get a badge
       id-token: write
 
     steps:
@@ -55,6 +58,24 @@ jobs:
           #   - See https://github.com/ossf/scorecard-action#publishing-results.
           publish_results: true
 
+          # Enable only Pinned-Dependencies check
+          checks: pinned-dependencies
+
+      # Add step to fail if Pinned-Dependencies check fails
+      - name: "Check Pinned Dependencies Score"
+        run: |
+          score=$(jq -r '.runs[0].results[] | select(.ruleId=="pinned-dependencies") | .score' results.sarif)
+          if (( $(echo "$score < 9" | bc -l) )); then
+            echo "Pinned-Dependencies check failed with score: $score"
+            echo "Please ensure all dependencies are pinned to specific versions."
+            echo "Common locations to check:"
+            echo "- GitHub Actions workflow files (.github/workflows/*.yml)"
+            echo "- Package manager files (package.json, requirements.txt, etc.)"
+            echo "- Docker images in Dockerfiles"
+            exit 1
+          fi
+          echo "Pinned-Dependencies check passed with score: $score"
+
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"