[dependabot]

Bumps the all-actions group with 1 update in the / directory: ossf/scorecard-action.

Updates ossf/scorecard-action from 2.4.4 to 2.5.0

Release notes

Sourced from ossf/scorecard-action's releases.

v2.5.0

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the Scorecard v5.6.0 release notes.

• The action's container image is built with Go 1.27.2 on a refreshed distroless base. by @​justaugustus in ossf/scorecard-action#1716
• The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in ossf/scorecard-action#1716
• The Scorecard version in results now always matches the Scorecard release the action is built with. by @​justaugustus in ossf/scorecard-action#1718
• The action no longer prints the GitHub token variable while validating its options. by @​arpitjain099 in ossf/scorecard-action#1709
• results_format accepts intoto, which wraps the JSON results in an in-toto attestation statement. by @​puerco in ossf/scorecard-action#1702

Other

• Add a daily canary against Scorecard main by @​justaugustus in ossf/scorecard-action#1711
• Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by @​justaugustus in ossf/scorecard-action#1714
• Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update RELEASE.md by @​justaugustus in ossf/scorecard-action#1716
• Bump Scorecard to v5.6.0 by @​justaugustus in ossf/scorecard-action#1719

New Contributors

• @​arpitjain099 made their first contribution in ossf/scorecard-action#1709
• @​puerco made their first contribution in ossf/scorecard-action#1702

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

Commits

• fa7117d Bump action tag for v2.5.0 release (#1720)
• cef4eb5 🌱 Bump Scorecard to v5.6.0 (#1719)
• bedb16e ✨ Add intoto results format (#1702)
• de70347 Remove the leftover debug print of the auth token (#1709)
• 950873d 🌱 Derive the reported Scorecard version from go.mod (#1718)
• 2ce8ee4 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (#1695)
• aabdf5a 🌱 Bump the github-actions group across 1 directory with 7 updates (#...
• b4b9adf 🌱 CodeQL: Analyze workflows instead of a placeholder JavaScript file
• 4e9f2a2 📖 RELEASE.md: Document drafting release notes
• f618e8b 🌱 Build the image with Go 1.27.2 and refresh distroless
• Additional commits viewable in compare view

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/ossf/scorecard-action	fa7117db83c52d787ae5a89f350999701505d78e	🟢 7.9	Details Check Score Reason Code-Review ⚠️ 1 Found 2/14 approved changesets -- score normalized to 1 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Dependency-Update-Tool 🟢 10 update tool detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Pinned-Dependencies 🟢 9 dependency not pinned by hash detected -- score normalized to 9 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Signed-Releases ⚠️ -1 no releases found License 🟢 10 license file detected Vulnerabilities 🟢 7 3 existing vulnerabilities detected Packaging 🟢 10 packaging workflow detected Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 20 out of 20 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 16 contributing companies or organizations

Scanned Files

• .github/workflows/openssf.yml

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (e578ab3) to head (bf2345b).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #134   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            2         2           
  Lines           37        37           
  Branches         3         3           
=========================================
  Hits            37        37           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
✅ ACTION	actionlint	8		0		0	0.11s
✅ ACTION	zizmor	8		0		0	2.97s
✅ EDITORCONFIG	editorconfig-checker	48		0		0	0.02s
✅ JSON	jsonlint	2		0		0	0.07s
✅ JSON	prettier	2		0		0	0.28s
✅ JSON	v8r	2		0		0	2.42s
✅ MARKDOWN	markdownlint	2		0		0	0.38s
✅ MARKDOWN	markdown-table-formatter	2		0		0	0.17s
✅ REPOSITORY	betterleaks	yes		no		no	0.58s
✅ REPOSITORY	checkov	yes		no		no	17.2s
✅ REPOSITORY	git_diff	yes		no		no	0.01s
✅ REPOSITORY	grype	yes		no		no	75.75s
✅ REPOSITORY	osv-scanner	yes		no		no	0.57s
✅ REPOSITORY	secretlint	yes		no		no	0.8s
✅ REPOSITORY	syft	yes		no		no	1.36s
✅ REPOSITORY	trivy-sbom	yes		no		no	0.33s
✅ REPOSITORY	trufflehog	yes		no		no	3.54s
✅ XML	xmllint	14		0		0	0.11s
✅ YAML	prettier	13		0		0	0.49s
✅ YAML	v8r	13		0		0	7.67s
✅ YAML	yamllint	13		0		0	0.61s

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[dorssel]

@dependabot rebase