matrix-art.meta

492.json (10747B)

---

 {
   "number": 492,
   "title": "Bump ossf/scorecard-action from 1.0.4 to 2.2.0",
   "state": "open",
   "diff_file": "492.diff",
   "author": "dependabot[bot]",
   "created_at": "2023-06-26T09:00:36Z",
   "closed_at": null,
   "merged_at": null,
   "base_ref": "main",
   "head_ref": "dependabot/github_actions/ossf/scorecard-action-2.2.0",
   "labels": [
     "dependencies",
     "github_actions"
   ],
   "assignees": [
     "MTRNord"
   ],
   "requested_reviewers": [
     "MTRNord"
   ],
   "body": "Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 1.0.4 to 2.2.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a href=\"https://github.com/ossf/scorecard-action/releases\">ossf/scorecard-action's releases</a>.</em></p>\n<blockquote>\n<h2>v2.2.0</h2>\n<h2>What's Changed</h2>\n<ul>\n<li>:seedling: Bump github.com/ossf/scorecard/v4 from v4.10.5 to v4.11.0 by <a href=\"https://github.com/spencerschrock\"><code>@\u200bspencerschrock</code></a> in <a href=\"https://redirect.github.com/ossf/scorecard-action/pull/1192\">ossf/scorecard-action#1192</a></li>\n</ul>\n<h2>Scorecard Result Viewer</h2>\n<p>Thanks to contributions from <a href=\"https://github.com/cynthia-sg\"><code>@\u200bcynthia-sg</code></a> and <a href=\"https://github.com/tegioz\"><code>@\u200btegioz</code></a> at <a href=\"https://github.com/cncf/clomonitor\">CLOMonitor</a>, there is a new Scorecard Result visualization page at <code>https://securityscorecards.dev/viewer/?uri=&lt;project-url&gt;</code>.</p>\n<ul>\n<li><a href=\"https://redirect.github.com/ossf/scorecard-webapp/pull/406\">ossf/scorecard-webapp#406</a></li>\n<li><a href=\"https://redirect.github.com/ossf/scorecard-webapp/pull/422\">ossf/scorecard-webapp#422</a></li>\n</ul>\n<p>As an example, you can see our own score visualized <a href=\"https://securityscorecards.dev/viewer/?uri=github.com/ossf/scorecard\">here</a>\nCheckout our <a href=\"https://github.com/ossf/scorecard-action/blob/08b4669551908b1024bb425080c797723083c031/README.md#scorecard-badge\">README</a> to learn how to link your README badge to the new visualization page.</p>\n<h2>Publishing Results</h2>\n<p>This release contains two fixes which will improve the user experience when <code>publish_results</code> is <code>true</code></p>\n<ul>\n<li>Runs that fail our <a href=\"https://github.com/ossf/scorecard-action/blob/08b4669551908b1024bb425080c797723083c031/README.md#workflow-restrictions\">workflow restrictions</a> will fail with a 400 response indicating the problem, instead of a vague 500 status. (<a href=\"https://redirect.github.com/ossf/scorecard-action/pull/1156\">ossf/scorecard-action#1156</a>, resolved <a href=\"https://redirect.github.com/ossf/scorecard-action/issues/1150\">ossf/scorecard-action#1150</a>)</li>\n<li>Scorecard action will retry when signing results and submitting them to our web API. This should help with flakiness from connection failures. (<a href=\"https://redirect.github.com/ossf/scorecard-action/pull/1191\">ossf/scorecard-action#1191</a>)</li>\n</ul>\n<h2>Docs</h2>\n<ul>\n<li>\ud83d\udcd6 Update README to accept fine-grained tokens by <a href=\"https://github.com/pnacht\"><code>@\u200bpnacht</code></a> in <a href=\"https://redirect.github.com/ossf/scorecard-action/pull/1175\">ossf/scorecard-action#1175</a></li>\n<li>\ud83d\udcd6 Update installation instructions to match current GitHub UI  by <a href=\"https://github.com/joycebrum\"><code>@\u200bjoycebrum</code></a> in <a href=\"https://redirect.github.com/ossf/scorecard-action/pull/1153\">ossf/scorecard-action#1153</a></li>\n<li>\ud83d\udcd6 Document the GitHub action workflow restrictions when publishing results. by <a href=\"https://github.com/spencerschrock\"><code>@\u200bspencerschrock</code></a> in</li>\n</ul>\n<h2>New Contributors</h2>\n<ul>\n<li><a href=\"https://github.com/bobcallaway\"><code>@\u200bbobcallaway</code></a> made their first contribution in <a href=\"https://redirect.github.com/ossf/scorecard-action/pull/1140\">ossf/scorecard-action#1140</a></li>\n<li><a href=\"https://github.com/pnacht\"><code>@\u200bpnacht</code></a> made their first contribution in <a href=\"https://redirect.github.com/ossf/scorecard-action/pull/1175\">ossf/scorecard-action#1175</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/ossf/scorecard-action/compare/v2.1.3...v2.2.0\">https://github.com/ossf/scorecard-action/compare/v2.1.3...v2.2.0</a></p>\n<h2>v2.1.3</h2>\n<h2>What's Changed</h2>\n<ul>\n<li>\ud83c\udf31 Bump github.com/ossf/scorecard/v4 from 4.10.2 to 4.10.5 by <a href=\"https://github.com/spencerschrock\"><code>@\u200bspencerschrock</code></a> in <a href=\"https://redirect.github.com/ossf/scorecard-action/pull/1111\">ossf/scorecard-action#1111</a></li>\n</ul>\n<h3>Bug Fixes</h3>\n<ul>\n<li>Invalid SARIF files from a bug in scorecard\n<ul>\n<li><a href=\"https://redirect.github.com/ossf/scorecard-action/issues/1076\">#1076</a>, <a href=\"https://redirect.github.com/ossf/scorecard-action/issues/1094\">#1094</a></li>\n</ul>\n</li>\n<li>Vulnerabilities check crashes if a vulnerable dependency is found via OSVScanner\n<ul>\n<li><a href=\"https://redirect.github.com/ossf/scorecard-action/issues/1092\">#1092</a></li>\n</ul>\n</li>\n<li>Scorecard action not reporting binary artifacts in the repo\n<ul>\n<li><a href=\"https://redirect.github.com/ossf/scorecard-action/issues/1116\">#1116</a></li>\n</ul>\n</li>\n</ul>\n<p><strong>Full Scorecard Changelog</strong>: <a href=\"https://github.com/ossf/scorecard/compare/v4.10.2...v4.10.5\">https://github.com/ossf/scorecard/compare/v4.10.2...v4.10.5</a></p>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/ossf/scorecard-action/compare/v2.1.2...v2.1.3\">https://github.com/ossf/scorecard-action/compare/v2.1.2...v2.1.3</a></p>\n<h2>v2.1.2</h2>\n<h2>What's Changed</h2>\n<h3>Fixes</h3>\n<!-- raw HTML omitted -->\n</blockquote>\n<p>... (truncated)</p>\n</details>\n<details>\n<summary>Commits</summary>\n<ul>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/08b4669551908b1024bb425080c797723083c031\"><code>08b4669</code></a> :seedling: Bump docker tag to for v2.2.0 release. (<a href=\"https://redirect.github.com/ossf/scorecard-action/issues/1194\">#1194</a>)</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/3c7470f58c4371d8ac58beaeeacf771227d63ce8\"><code>3c7470f</code></a> :book: Update README badge link to use new uri param. (<a href=\"https://redirect.github.com/ossf/scorecard-action/issues/1185\">#1185</a>)</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/a164dbc12a66d9fae8ec379fff6ba200da366366\"><code>a164dbc</code></a> :seedling: Bump github.com/ossf/scorecard/v4 from v4.10.5 to v4.11.0 (<a href=\"https://redirect.github.com/ossf/scorecard-action/issues/1192\">#1192</a>)</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/597960e1d95e5c741af238a819f03655e2fa43b8\"><code>597960e</code></a> :book: Update README to accept fine-grained tokens (<a href=\"https://redirect.github.com/ossf/scorecard-action/issues/1175\">#1175</a>)</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/8808ed28c3b8ba5a7d8059bd0360d8374ff6adb3\"><code>8808ed2</code></a> :seedling: Retry external network calls when publishing results (<a href=\"https://redirect.github.com/ossf/scorecard-action/issues/1191\">#1191</a>)</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/0eed6cb5da014387b234df059cd4a2db5dbe9e1f\"><code>0eed6cb</code></a> :seedling: Bump golang.org/x/net from 0.10.0 to 0.11.0</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/6c6335c126308fd03da1c3bb267c1ebc3a34db0c\"><code>6c6335c</code></a> :seedling: Bump github/codeql-action from 2.3.6 to 2.20.0</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/7f1baf380a4f4418b4864d5a57bee1beba03e2eb\"><code>7f1baf3</code></a> :book: Switch recommended badge link to the new viewer. (<a href=\"https://redirect.github.com/ossf/scorecard-action/issues/1176\">#1176</a>)</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/df98bbc13d1c3001cc90b8a2791ffde7ba29f061\"><code>df98bbc</code></a> :seedling: Bump actions/checkout from 3.5.2 to 3.5.3</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/75886d414a5cd048874360697f1e8edb5b1e55ca\"><code>75886d4</code></a> :seedling: Bump golangci/golangci-lint-action from 3.5.0 to 3.6.0 (<a href=\"https://redirect.github.com/ossf/scorecard-action/issues/1172\">#1172</a>)</li>\n<li>Additional commits viewable in <a href=\"https://github.com/ossf/scorecard-action/compare/c1aec4ac820532bab364f02a81873c555a0ba3a1...08b4669551908b1024bb425080c797723083c031\">compare view</a></li>\n</ul>\n</details>\n<br />\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ossf/scorecard-action&package-manager=github_actions&previous-version=1.0.4&new-version=2.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n<details>\n<summary>Dependabot commands and options</summary>\n<br />\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot merge` will merge this PR after your CI passes on it\n- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it\n- `@dependabot cancel merge` will cancel a previously requested merge and block automerging\n- `@dependabot reopen` will reopen this PR if it is closed\n- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n</details>\n\n<!-- Replace -->\n----\n\u231b Deploy Preview - Build in Progress\n<!-- Replace -->\n",
   "comments": [],
   "review_comments": []
 }