[renovate]

This PR contains the following updates:

Package	Type	Update	Change
ossf/scorecard-action	action	minor	v2.4.4 → v2.5.0

---

Release Notes

ossf/scorecard-action

v2.5.0

Compare Source

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.

• The action's container image is built with Go 1.27.2 on a refreshed distroless base. by
  @​justaugustus in #​1716
• The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still
  recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in #​1716
• The Scorecard version in results now always matches the Scorecard release the action is built
  with. by @​justaugustus in #​1718
• The action no longer prints the GitHub token variable while validating its options. by
  @​arpitjain099 in #​1709
• results_format accepts intoto, which wraps the JSON results in an in-toto attestation
  statement. by @​puerco in #​1702

Other

• Add a daily canary against Scorecard main by @​justaugustus in #​1711
• Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by @​justaugustus in #​1714
• Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update
  RELEASE.md by @​justaugustus in #​1716
• Bump Scorecard to v5.6.0 by @​justaugustus in #​1719

New Contributors

• @​arpitjain099 made their first contribution in #​1709
• @​puerco made their first contribution in #​1702

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.60%. Comparing base (272785e) to head (edfc124).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #930      +/-   ##
============================================
+ Coverage     87.19%   87.60%   +0.41%     
  Complexity     1284     1284              
============================================
  Files            51       51              
  Lines          4131     4131              
  Branches        569      569              
============================================
+ Hits           3602     3619      +17     
+ Misses          309      292      -17     
  Partials        220      220              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.