Scorecard Pinned-Dependencies — Triage Explorer

25 open PinnedDependenciesID alerts from OpenSSF Scorecard on orchestkit @ 2026-06-01. Toggle the two remediations this PR ships and watch the open code-scanning count resolve. Then flip on the "future unpinned action" probe to prove the hybrid filter still catches the one failure class that matters — exactly the ci-sentinel.yml slip that triggered this work.

Remediations (this PR)

SHA-pin the 2 GitHub Actions
ci-sentinel.yml checkout@v6 & setup-node@v6 → commit SHA. Fixed at source → Scorecard stops flagging. Hybrid SARIF filter (npm + pip)
Drop npmCommand/pipCommand findings before upload. They can't be hash-pinned, so they're permanent noise.

Probe: does signal survive?

Simulate a new unpinned action
Pretend someone adds actions/foo@v3 next month. A good filter must still surface it.

Alternatives (compare)

Approach ②-naive: drop ALL pinned-deps
Filter the whole PinnedDependenciesID rule. Quiet — but blinds you to real action regressions.

Open = still alerts · Fixed = pinned at source · Dropped = filtered · Kept = filter let it through (good for actions)

Open alerts

Resolved

Fixed at source

Kept (signal)

Type	Location	Alert	Disposition

Generated SARIF filter (scorecard.yml)