build(deps): bump ossf/scorecard-action from 2.0.3 to 2.4.4

[dependabot]

Bumps ossf/scorecard-action from 2.0.3 to 2.4.4.

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.4

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

• log POST failures instead of failing entire action by @​spencerschrock in ossf/scorecard-action#1625

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

v2.4.3

What's Changed

This update bumps the Scorecard version to the v5.3.0 release. For a complete list of changes, please refer to the Scorecard v5.3.0 release notes.

Documentation

• docs: clarify GITHUB_TOKEN permissions needed for private repos by @​pankajtaneja5 in ossf/scorecard-action#1574
• 📖 Fix recommended command to test the image in development by @​deivid-rodriguez in ossf/scorecard-action#1583

Other

• add missing top-level token permissions to workflows by @​timothyklee in ossf/scorecard-action#1566
• setup codeowners for requesting reviews by @​spencerschrock in ossf/scorecard-action#1576
• 🌱 Improve printing options by @​deivid-rodriguez in ossf/scorecard-action#1584

New Contributors

• @​timothyklee made their first contribution in ossf/scorecard-action#1566
• @​pankajtaneja5 made their first contribution in ossf/scorecard-action#1574
• @​deivid-rodriguez made their first contribution in ossf/scorecard-action#1584

Full Changelog: ossf/scorecard-action@v2.4.2...v2.4.3

v2.4.2

What's Changed

This update bumps the Scorecard version to the v5.2.1 release. For a complete list of changes, please refer to the Scorecard v5.2.0 and v5.2.1 release notes.

Full Changelog: ossf/scorecard-action@v2.4.1...v2.4.2

v2.4.1

What's Changed

• This update bumps the Scorecard version to the v5.1.1 release. For a complete list of changes, please refer to the v5.1.0 and v5.1.1 release notes.
• Publishing results now uses half the API quota as before. The exact savings depends on the repository in question.
  • use Scorecard library entrypoint instead of Cobra hooking by @​spencerschrock in ossf/scorecard-action#1423
• Some errors were made into annotations to make them more visible
  • Make default branch error more prominent by @​jsoref in ossf/scorecard-action#1459
• There is now an optional file_mode input which controls how repository files are fetched from GitHub. The default is archive, but git produces the most accurate results for repositories with .gitattributes files at the cost of analysis speed.
  • add input for specifying --file-mode by @​spencerschrock in ossf/scorecard-action#1509
• The underlying container for the action is now hosted on GitHub Container Registry. There should be no functional changes.
  • 🌱 publish docker images to GitHub Container Registry by @​spencerschrock in ossf/scorecard-action#1453

Docs

... (truncated)

Changelog

Sourced from ossf/scorecard-action's changelog.

Releasing the scorecard GitHub Action

This is a draft document to describe the release process for the scorecard GitHub Action.

(If there are improvements you'd like to see, please comment on the tracking issue or issue a pull request to discuss.)

• Tracking
• Preparing the release
  • Validate the Action
  • Update the scorecard-action version
• Drafting release notes
• Release
  • Create a tag
  • Create a GitHub release
• Update the starter workflow
• Announce

Tracking

As the first task, a Release Manager should open a tracking issue for the release.

We don't currently have a template for releasing, but the following issue is a good example to draw inspiration from.

We're not striving for perfection with the template, but the tracking issue will serve as a reference point to aggregate feedback, so try your best to be as descriptive as possible.

Preparing the release

This section covers changes that need to be issued as a pull request and should be merged before releasing the scorecard GitHub Action.

Validate the Action

The postsubmits.yml workflow runs on every push to main and weekly. It builds and pushes the ghcr.io/ossf/scorecard-action:latest image, then runs Scorecard on this repository with that image, uploading the SARIF and publishing the results.

Confirm that the postsubmits.yml run for the commit you plan to release succeeded, including the Scorecard analysis job (no error sending scorecard results line in its log). If there isn't one, run the workflow manually.

... (truncated)

Commits

• 2d11466 Bump action tag for v2.4.4 release (#1688)
• 1bd3285 🌱 Bump the docker-images group across 1 directory with 2 updates (#1...
• 913edce 🌱 Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (#1671)
• 0957b8f 🌱 Bump golang.org/x/net from 0.56.0 to 0.57.0 (#1680)
• f0061eb 🌱 Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#1687)
• 20ee732 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 (#1685)
• 9f295ef 🌱 Bump the github-actions group with 6 updates (#1686)
• 69bf556 🌱 Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 (#1681)
• 94e8b96 🌱 Bump github.com/sigstore/rekor from 1.5.0 to 1.5.2 (#1673)
• c7a1b37 🌱 Bump github.com/sigstore/fulcio from 1.8.5 to 1.8.6 (#1675)
• Additional commits viewable in compare view