The action ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a is not allowed in reponomics/reponomics-dashboard-action because all actions must be from a repository owned by reponomics, created by GitHub, or match one of the patterns: amannn/action-semantic-pull-request@*, googleapis/release-please-action@*. All actions must also be pinned to a full-length commit SHA.