Github runs are warning/failing because of out of date node configuration about scorecard HOT 1 CLOSED

This isn't due to node, but rather due to ossf/scorecard-action#997 (comment). Although both are due to out-of-date versions.

Please upgrade your version of scorecard action to v2.3.1 (whose hash is 0864cf19026789058feabb7e87baa5f140aac736)

The install instructions

We have a patch for the starter workflow in review (actions/starter-workflows#2348), and will make similar changes to our scorecard action readme which has admittedly drifted out of date.

I also expect that the project has numbered releases so humans can reason about updates more easily.

For our rationale, please read "Pin actions to a full length commit SHA" and "Pin actions to a tag only if you trust the creator"
https://docs.github.com/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions.

You're more than welcome to use @v2 or @v2.3.1 in your workflow, but Scorecard recommends for pinned dependencies. Tools like dependabot can help maintain human readability in the form on version comments which the tools will update for you. E.g. https://github.com/ossf/scorecard/pull/3599/files

from scorecard.