Skip to content

Bump ossf/scorecard-action from 2.4.4 to 2.5.0 - #201

Merged
atkrad merged 1 commit into
mainfrom
dependabot/github_actions/ossf/scorecard-action-2.5.0
Oct 26, 2026
Merged

atkrad merged 1 commit into
mainfrom
dependabot/github_actions/ossf/scorecard-action-2.5.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •

Copy link
Copy Markdown
Contributor

Bumps ossf/scorecard-action from 2.4.4 to 2.5.0.

Release notes

Sourced from ossf/scorecard-action's releases.

v2.5.0

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the Scorecard v5.6.0 release notes.

Other

New Contributors

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

Commits
  • fa7117d Bump action tag for v2.5.0 release (#1720)
  • cef4eb5 🌱 Bump Scorecard to v5.6.0 (#1719)
  • bedb16e ✨ Add intoto results format (#1702)
  • de70347 Remove the leftover debug print of the auth token (#1709)
  • 950873d 🌱 Derive the reported Scorecard version from go.mod (#1718)
  • 2ce8ee4 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (#1695)
  • aabdf5a 🌱 Bump the github-actions group across 1 directory with 7 updates (#...
  • b4b9adf 🌱 CodeQL: Analyze workflows instead of a placeholder JavaScript file
  • 4e9f2a2 📖 RELEASE.md: Document drafting release notes
  • f618e8b 🌱 Build the image with Go 1.27.2 and refresh distroless
  • Additional commits viewable in compare view

@dependabot
dependabot Bot requested a review from atkrad as a code owner October 19, 2026 00:59
@dependabot dependabot Bot added area/ci GitHub Actions and release packaging kind/chore Cleanup, deps, CI, or refactor with no user-facing change labels Oct 19, 2026
@codecov

codecov Bot commented Oct 19, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/ossf/scorecard-action-2.5.0 branch from 248c86f to b5fdb7e Compare October 26, 2026 12:54
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@2d11466...fa7117d)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@atkrad
atkrad force-pushed the dependabot/github_actions/ossf/scorecard-action-2.5.0 branch from b5fdb7e to 0b68f52 Compare October 26, 2026 13:15
@atkrad
atkrad merged commit e6e02f8 into main Oct 26, 2026
17 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/ossf/scorecard-action-2.5.0 branch October 26, 2026 13:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/ci GitHub Actions and release packaging kind/chore Cleanup, deps, CI, or refactor with no user-facing change

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant