SIGSEGV in PinningDependencies (possibly related to YAML aliases)

[smdn]

I have been using ossf/scorecard-action v2.4.3, but it has recently started failing with a SIGSEGV error as shown below:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x194e8ec]

goroutine 79 [running]:
github.com/ossf/scorecard/v5/checks/evaluation.PinningDependencies({0x3aff2e0, 0x13}, {0xc000761008, 0x15, 0x320018?}, {0x40335f8, 0xc000a0c030})
	github.com/ossf/scorecard/v5@v5.3.0/checks/evaluation/pinned_dependencies.go:89 +0x42c
github.com/ossf/scorecard/v5/checks.PinningDependencies(0xc000e1b360)
	github.com/ossf/scorecard/v5@v5.3.0/checks/pinned_dependencies.go:61 +0x2e5
github.com/ossf/scorecard/v5/checker.(*Runner).Run(0xc0005f3f08, {0x4033298, 0x62e73e0}, {0x3cb0f60?, {0xc000448850?, 0x0?, 0x0?}})
	github.com/ossf/scorecard/v5@v5.3.0/checker/check_runner.go:118 +0x8f7
github.com/ossf/scorecard/v5/pkg/scorecard.runEnabledChecks.func1()
	github.com/ossf/scorecard/v5@v5.3.0/pkg/scorecard/scorecard.go:65 +0x1b0
created by github.com/ossf/scorecard/v5/pkg/scorecard.runEnabledChecks in goroutine 15
	github.com/ossf/scorecard/v5@v5.3.0/pkg/scorecard/scorecard.go:57 +0x106

Currently, scorecard-action is invoked with the following configuration:

# .github/workflows/scorecard.yml

      - name: "Run analysis"
        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
        with:
          results_file: results.sarif
          results_format: sarif
          publish_results: true

The full output when the SIGSEGV occurred can be found at https://github.com/smdn/workflows-dotnet/actions/runs/28697328016/job/85126493337

Possible Cause

Before this SIGSEGV started occurring, I made the following changes to the workflow file.
These changes added steps that utilize YAML alias syntax for the uses key.
It is highly possible that evaluation.PinningDependencies fails to correctly parse the action being depended on due to this alias syntax, leading to the SIGSEGV.

-    - name: Checkout repository
+    - name: &checkout-repository-name Checkout repository
       id: checkout-repository
+      if: runner.os != 'Windows'
       background: true
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      with:
+      uses: &checkout-repository-action actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with: &checkout-repository-action-params
         token: ${{ secrets.token_repo }}
         fetch-depth: 1
 
+    - name: *checkout-repository-name
+      id: checkout-repository-non-background
+      # Workaround: Run synchronously on Windows to avoid OS-specific file locking conflicts (sharing violations).
+      # Since 'background' does not accept expressions (${{ ... }}), YAML anchors are used to reuse configurations across split steps.
+      if: runner.os == 'Windows'
+      uses: *checkout-repository-action
+      with: *checkout-repository-action-params