Context

The three github/codeql-action/* references in codeql.yml and scorecard.yml use mutable git tags rather than commit SHAs, so semgrep-code-mongodb flags them on every version bump that touches those lines. They are the only unpinned action references left in .github/workflows; everything else already folows the actions/checkout@<sha> #v7.0.1 pattern used elsewhere in the same files.

Definition of done

All three references are pinned to full commit SHAs with the version retained as the trailing comment, and the Semgrep finding no longer appears ton workflow bumps. If the team instead decides these are acceptable as tags because github/codeql-action publishes immutable releases, that determination is confirmed and recorded in a suppression comment rather than left implicit in #immutable.

Pitfalls

NA