[efegokdemir]

Summary

Pin the Scorecard workflow to the verified v2.5.0 commit.

Motivation

Align the scheduled analysis with Scorecard Action v2.5.0 while retaining published results and SARIF reporting.

Changes

• Update ossf/scorecard-action to fa7117db83c52d787ae5a89f350999701505d78e (v2.5.0).
• Retain publish_results: true, existing permissions and triggers, and the SARIF upload.

Tests performed

• Checks run below.
• actionlint .github/workflows/scorecard.yml and npm run format:check passed.
• npm ci; npm test (122 passed); npm run coverage (122 passed; configured thresholds met); npm run lint; npm audit (0 vulnerabilities); npm run package:check; npm run package:smoke; and npm run action:check passed.

Compatibility

No application runtime or package changes. Local checks ran on Node 26.10.0/npm 11.19.1; hosted Node 22/24 checks are pending.

Security and privacy

The existing job-scoped permissions, published results and SARIF reporting are unchanged.

Shopify source/evidence

N/A.

Release impact

Repository CI workflow only. No product Action behaviour, package behaviour, documentation, package version or release workflow changes; no npm release.

Checklist

• The change is focused and the docs/examples match the implementation.
• Relevant regression tests and checks are recorded above.
• Generated distributions are up to date where required; none are needed for this workflow-only change.
• No sensitive or unreviewed third-party material was added.