Skip to content

chore(deps): update ossf/scorecard-action action to v2.5.0 - #4491

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ossf-scorecard-action-2.x
Open

chore(deps): update ossf/scorecard-action action to v2.5.0#4491
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ossf-scorecard-action-2.x

Conversation

@renovate

@renovate renovate Bot commented Sep 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
ossf/scorecard-action action minor v2.4.3 → v2.5.0

Release Notes

ossf/scorecard-action (ossf/scorecard-action)

v2.5.0

Compare Source

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.

  • The action's container image is built with Go 1.27.2 on a refreshed distroless base. by
    @​justaugustus in #​1716
  • The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still
    recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in #​1716
  • The Scorecard version in results now always matches the Scorecard release the action is built
    with. by @​justaugustus in #​1718
  • The action no longer prints the GitHub token variable while validating its options. by
    @​arpitjain099 in #​1709
  • results_format accepts intoto, which wraps the JSON results in an in-toto attestation
    statement. by @​puerco in #​1702
Other

New Contributors

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

v2.4.4

Compare Source

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added automated Created by automation do-not-merge/hold Indicates that a PR should not merge because someone has issued /hold labels Sep 26, 2026
@renovate renovate Bot added the automated Created by automation label Sep 26, 2026
@renovate renovate Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued /hold label Sep 26, 2026
@coderabbitai

coderabbitai Bot commented Sep 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository: cozystack/cozystack/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: eb93349c-1b2c-485b-b6d2-871acc1cd560

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added area/dependencies Dependency bumps (Renovate, go.mod); scope `deps` size/XS This PR changes 0-9 lines, ignoring generated files kind/cleanup Categorizes issue or PR as related to cleanup of code, process, or technical debt labels Sep 26, 2026
@renovate
renovate Bot force-pushed the renovate/ossf-scorecard-action-2.x branch from b5db604 to 36ab450 Compare September 30, 2026 18:03
@lexfrei Aleksei Sviridkin (lexfrei) mentioned this pull request Oct 11, 2026
Open
12 tasks
@renovate renovate Bot changed the title chore(deps): update ossf/scorecard-action action to v2.4.4 chore(deps): update ossf/scorecard-action action to v2.5.0 Oct 12, 2026
@renovate
renovate Bot force-pushed the renovate/ossf-scorecard-action-2.x branch from 36ab450 to 90ffce3 Compare October 12, 2026 04:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kvaps Andrei Kvapil (kvaps) Awaiting requested review from kvaps kvaps is a code owner
@lllamnyp Timofei Larkin (lllamnyp) Awaiting requested review from lllamnyp lllamnyp is a code owner
@lexfrei Aleksei Sviridkin (lexfrei) Awaiting requested review from lexfrei lexfrei is a code owner
@myasnikovdaniil myasnikovdaniil Awaiting requested review from myasnikovdaniil myasnikovdaniil is a code owner
@IvanHunters IvanHunters Awaiting requested review from IvanHunters IvanHunters is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

area/dependencies Dependency bumps (Renovate, go.mod); scope `deps` automated Created by automation do-not-merge/hold Indicates that a PR should not merge because someone has issued /hold kind/cleanup Categorizes issue or PR as related to cleanup of code, process, or technical debt size/XS This PR changes 0-9 lines, ignoring generated files

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants