KofTwentyTwo/AppKit
2
0 Fork 0
Code Issues 22 Pull Requests 4 Actions Packages Projects Releases 1 Wiki Activity

ci: Bump ossf/scorecard-action from 2.4.4 to 2.5.0 in the actions group #30

Closed
dependabot[bot] wants to merge 1 commits from dependabot/github_actions/actions-dd3649b633 into main
pull from: dependabot/github_actions/actions-dd3649b633
merge into: KofTwentyTwo:main
Conversation 2 Commits 1 Files Changed 1
+1 -1
dependabot[bot] commented 2026-10-19 05:27:33 +00:00 (Migrated from github.com)
Copy link
Copy source

Bumps the actions group with 1 update: ossf/scorecard-action.

Updates ossf/scorecard-action from 2.4.4 to 2.5.0

Release notes

Sourced from ossf/scorecard-action's releases.

v2.5.0

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the Scorecard v5.6.0 release notes.

Other

New Contributors

Full Changelog: https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0

Commits
  • fa7117d Bump action tag for v2.5.0 release (#1720)
  • cef4eb5 🌱 Bump Scorecard to v5.6.0 (#1719)
  • bedb16e ✨ Add intoto results format (#1702)
  • de70347 Remove the leftover debug print of the auth token (#1709)
  • 950873d 🌱 Derive the reported Scorecard version from go.mod (#1718)
  • 2ce8ee4 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (#1695)
  • aabdf5a 🌱 Bump the github-actions group across 1 directory with 7 updates (#...
  • b4b9adf 🌱 CodeQL: Analyze workflows instead of a placeholder JavaScript file
  • 4e9f2a2 📖 RELEASE.md: Document drafting release notes
  • f618e8b 🌱 Build the image with Go 1.27.2 and refresh distroless
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
Bumps the actions group with 1 update: [ossf/scorecard-action](https://github.com/ossf/scorecard-action). Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ossf/scorecard-action/releases">ossf/scorecard-action's releases</a>.</em></p> <blockquote> <h2>v2.5.0</h2> <h2>What's Changed</h2> <p>This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure.</p> <p>For changes to checks and results, and what the infrastructure move means for you, see the <a href="https://github.com/ossf/scorecard/releases/tag/v5.6.0">Scorecard v5.6.0 release notes</a>.</p> <ul> <li>The action's container image is built with Go 1.27.2 on a refreshed distroless base. by <a href="https://github.com/justaugustus"><code>@​justaugustus</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1716">ossf/scorecard-action#1716</a></li> <li>The installer (<code>cmd/installer</code>) now creates <code>.github/workflows/scorecard.yml</code>, and still recognizes existing <code>scorecards.yml</code> and <code>scorecards-analysis.yml</code> workflows. by <a href="https://github.com/justaugustus"><code>@​justaugustus</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1716">ossf/scorecard-action#1716</a></li> <li>The Scorecard version in results now always matches the Scorecard release the action is built with. by <a href="https://github.com/justaugustus"><code>@​justaugustus</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1718">ossf/scorecard-action#1718</a></li> <li>The action no longer prints the GitHub token variable while validating its options. by <a href="https://github.com/arpitjain099"><code>@​arpitjain099</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1709">ossf/scorecard-action#1709</a></li> <li><code>results_format</code> accepts <code>intoto</code>, which wraps the JSON results in an in-toto attestation statement. by <a href="https://github.com/puerco"><code>@​puerco</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1702">ossf/scorecard-action#1702</a></li> </ul> <h3>Other</h3> <ul> <li>Add a daily canary against Scorecard main by <a href="https://github.com/justaugustus"><code>@​justaugustus</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1711">ossf/scorecard-action#1711</a></li> <li>Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by <a href="https://github.com/justaugustus"><code>@​justaugustus</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1714">ossf/scorecard-action#1714</a></li> <li>Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update RELEASE.md by <a href="https://github.com/justaugustus"><code>@​justaugustus</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1716">ossf/scorecard-action#1716</a></li> <li>Bump Scorecard to v5.6.0 by <a href="https://github.com/justaugustus"><code>@​justaugustus</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1719">ossf/scorecard-action#1719</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/arpitjain099"><code>@​arpitjain099</code></a> made their first contribution in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1709">ossf/scorecard-action#1709</a></li> <li><a href="https://github.com/puerco"><code>@​puerco</code></a> made their first contribution in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1702">ossf/scorecard-action#1702</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0">https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ossf/scorecard-action/commit/fa7117db83c52d787ae5a89f350999701505d78e"><code>fa7117d</code></a> Bump action tag for v2.5.0 release (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1720">#1720</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/cef4eb5d6088e4adcf03f9d62997f3bb26a8f09c"><code>cef4eb5</code></a> :seedling: Bump Scorecard to v5.6.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1719">#1719</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/bedb16e17db10ec69e7ee324652b5fe4a1ef05fe"><code>bedb16e</code></a> :sparkles: Add intoto results format (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1702">#1702</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/de70347fd7cf68f25ffab60983dd64a81bc10c77"><code>de70347</code></a> Remove the leftover debug print of the auth token (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1709">#1709</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/950873de57049dbae181637f165e7992d3f63d0a"><code>950873d</code></a> :seedling: Derive the reported Scorecard version from go.mod (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1718">#1718</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/2ce8ee42fdf35edce28a64fa8a6cfc162ba359e7"><code>2ce8ee4</code></a> :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1695">#1695</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/aabdf5ad3b10f2d6c993d6fb177a301fd6bb0db9"><code>aabdf5a</code></a> :seedling: Bump the github-actions group across 1 directory with 7 updates (#...</li> <li><a href="https://github.com/ossf/scorecard-action/commit/b4b9adf9b43b304ae7e11c3fdec496a1a437052f"><code>b4b9adf</code></a> :seedling: CodeQL: Analyze workflows instead of a placeholder JavaScript file</li> <li><a href="https://github.com/ossf/scorecard-action/commit/4e9f2a270106ff88d667a0490660d05e2f1adb04"><code>4e9f2a2</code></a> :book: RELEASE.md: Document drafting release notes</li> <li><a href="https://github.com/ossf/scorecard-action/commit/f618e8bbfd5d42b160e1e8a472e5efd90e6a15ea"><code>f618e8b</code></a> :seedling: Build the image with Go 1.27.2 and refresh distroless</li> <li>Additional commits viewable in <a href="https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ossf/scorecard-action&package-manager=github_actions&previous-version=2.4.4&new-version=2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details>
KofTwentyTwo (Migrated from github.com) reviewed 2026-10-19 05:27:33 +00:00
dependabot[bot] commented 2026-10-26 05:53:19 +00:00 (Migrated from github.com)
Copy link
Copy source

Looks like ossf/scorecard-action is updatable in another way, so this is no longer needed.

Looks like ossf/scorecard-action is updatable in another way, so this is no longer needed.

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
KofTwentyTwo
Labels
Clear labels
accessibility
Barrier affecting people with disabilities
 bug
Something isn't working
 deferred
Agreed follow-up, unscheduled
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 needs-owner
Blocked on the owner
 priority
Work this first
 quality
Tests, gates, and code quality
 question
Further information is requested
 refactor
Internal restructuring, no behavior change
 release
Release and packaging
 wontfix
This will not be worked on
No labels dependencies github_actions
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/AppKit#30