fix: pin third-party actions, pip installs, and sentinel's base image

[kingztech2019]

PR 2 of 3 from #77 (scope confirmed here): PinnedDependenciesID across the 8 named files.

What changed

File	Unpinned	Pinned to
codeql.yml	actions/checkout@v7.0.1, github/codeql-action/{init,autobuild,analyze}@v4	existing repo SHA for checkout; codeql-action's current v4.37.8 commit
scorecard.yml	actions/checkout@v7.0.1, github/codeql-action/upload-sarif@v4	same two SHAs as above
scheduled-agents-tests.yml	bare pytest (2 jobs)	pytest==9.1.1
agentrust-codex-tests.yml	bare pytest (2 jobs), jsonschema pyyaml	pytest==9.1.1, jsonschema==4.26.0, pyyaml==6.0.3
claude-code-tests.yml	bare pytest (2 jobs)	pytest==9.1.1
spendguard-conformance.yml	pip install --upgrade pip, agentrust-trace agentrust-trace-tests	pip==26.2.1, agentrust-trace==0.9.0, agentrust-trace-tests==0.5.1
integrations/sentinel/Dockerfile	FROM python:3.11-slim	pinned to its current manifest-list digest

ramen-ai-cmcp-conformance.yml, also in the named list, needed no change: its actions are already SHA-pinned and its only pip install is a local editable install (-e "integrations/ramen-ai-cmcp[test]"), no bare external package name to pin.

pytest==9.1.1 and agentrust-trace==0.9.0 match what ramen-ai-cmcp/pyproject.toml already pins, for consistency. agentrust-trace-tests==0.5.1 is current PyPI latest — ramen-ai-cmcp/pyproject.toml itself pins 0.5.0, one behind; noting it, not touching it, out of scope here.

Verification

python -c "
import yaml
for f in ['.github/workflows/codeql.yml', '.github/workflows/scorecard.yml',
          '.github/workflows/spendguard-conformance.yml', '.github/workflows/scheduled-agents-tests.yml',
          '.github/workflows/agentrust-codex-tests.yml', '.github/workflows/claude-code-tests.yml']:
    yaml.safe_load(open(f))
"
# all 6 edited workflow files parse

python scripts/validate_integrations.py       # 17 integrations, 0 failures
python scripts/generate_integration_index.py --check
python scripts/validate_compatibility.py       # 0 failures

Didn't have access to the code-scanning API to pull the exact PinnedDependenciesID alert list (403, contributor-level auth) — went through the 8 named files by hand and applied Scorecard's known Pinned-Dependencies criteria (SHA-pinned actions, versioned pip installs, digest-pinned base images) to whatever was actually unpinned in each.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[imran-siddique]

Verified every pin at source rather than trusting the comments, because a wrong SHA in a pinning PR is worse than no pin: it looks pinned and is not, and nobody re-checks it afterwards.

Pin	Checked against	Result
actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1	git/ref/tags/v7.0.1	exact match
github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28	v4.37.8 annotated tag, dereferenced	exact match, commit dated 2026-08-21
python:3.11-slim@sha256:9c900dea9e8fb7e16277c179b555cc72d29a352dbc33cff48ad5a0412fd5bfc7	live docker-content-digest from Docker Hub	exact match
pytest==9.1.1, agentrust-trace==0.9.0, agentrust-trace-tests==0.5.1, jsonschema==4.26.0, pyyaml==6.0.3, pip==26.2.1	PyPI	all exist, all current latest

The codeql one deserves a note for whoever audits this next. Its v4.37.8 ref is an annotated tag object, so a direct ref lookup returns 37f2634a... and the pin reads as wrong. Dereferencing the tag to its commit gives exactly db488dde.... Your # v4.37.8 comments are accurate; the naive check is what is misleading.

Two scope calls I checked rather than assumed, and both are right.

Leaving ramen-ai-cmcp-conformance.yml untouched with the reason stated: its actions are already SHA-pinned and its only pip install is -e against a path, so there is no external name to pin. A PR that touched it anyway to make the file count match the issue would have been worse.

Noticing that ramen-ai-cmcp/pyproject.toml pins agentrust-trace-tests==0.5.0 while you pin 0.5.1 here, and saying so without fixing it. That is a real inconsistency and it is also genuinely out of scope for a workflow-pinning PR. Flagged is the right treatment.

Matching pytest==9.1.1 and agentrust-trace==0.9.0 to what ramen-ai-cmcp/pyproject.toml already pins is the detail that makes this maintainable: one version per package across the repo means the next bump is one decision, not eight.

Approving and merging.