ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 is not allowed to be used in RedHatProductSecurity/trestle-bot. Actions in this workflow must be: within a repository owned by RedHatProductSecurity, created by GitHub, or matching the following: sonarsource/sonarcloud-github-action@*, sonarsource/sonarqube-quality-gate-action@*, aquasecurity/trivy-action@*, sigstore/cosign-installer@*, docker/build-push-action@*, docker/login-action@*, docker/metadata-action@*, docker/setup-buildx-action@*, docker/setup-qemu-action@*, oxsecurity/megalinter@*, googleapis/release-please-action@*.