Summary

Pin four Docker actions in .github/workflows/test.yml to the exact commits currently resolved by the existing v2/v3/v3/v5 tags. This preserves selected action versions, inputs, credentials, permissions, test cases and Scout v1.27.0 assets. No application code, generated bundle, release assets or organization policy changes.

Diff scope: dependency-plus-source (workflow configuration only).

Why

The v1.27.0 release PR test run is rejected before any job starts: the Actions allowlist rejects docker/login-action@v2, docker/setup-qemu-action@v3, docker/setup-buildx-action@v3 and docker/build-push-action@v5. The v1.26.0 run has the same annotation. All four are grouped because they jointly block this single workflow from starting.

The QEMU, Buildx and build-push commits also match Scout source CI. Login deliberately stays on v2 rather than introducing a major/authentication migration. Hosted CI must establish whether this pin is admitted by policy; pinning alone does not prove allowlist membership.

This workflow belongs to the distribution repository and is not generated from the Scout source assets.

Validation

• Resolved all four tags through the upstream GitHub Git API before pinning; no version change from the resolved baseline.
• git diff --check passed.
• zizmor --offline --no-progress .github/workflows/test.yml: all four unpinned-action findings removed; existing checkout-credential and self-repository advisories unchanged. No new findings.
• Scope validator passed as dependency-plus-source (workflow configuration), with evidence-file warning only; dependency-only classification is not applicable to this path.
• The existing workflow exercises quickview, cves and compare against published Scout v1.27.0. Hosted result pending; no integration-test success is claimed.
• No runtime-code change; no new unit tests or coverage changes. No manual workflow dispatch/rerun performed.

Risk and rollback

CI-only repair. No security-policy exception is requested. Revert this commit to restore prior references, which restores the known startup blocker. Any further startup or runtime test failures require separate investigation.