492.md (10293B)
1 # PR #492 Bump ossf/scorecard-action from 1.0.4 to 2.2.0 2 3 - **Status:** open 4 - **Author:** @dependabot[bot] 5 - **Created:** 2023-06-26T09:00:36Z 6 - **Branch:** dependabot/github_actions/ossf/scorecard-action-2.2.0 → main 7 - **Labels:** dependencies, github_actions 8 - **Assignees:** @MTRNord 9 - **Reviewers:** @MTRNord 10 - **Diff:** [492.diff](./492.diff) 11 12 --- 13 14 Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 1.0.4 to 2.2.0. 15 <details> 16 <summary>Release notes</summary> 17 <p><em>Sourced from <a href="https://github.com/ossf/scorecard-action/releases">ossf/scorecard-action's releases</a>.</em></p> 18 <blockquote> 19 <h2>v2.2.0</h2> 20 <h2>What's Changed</h2> 21 <ul> 22 <li>:seedling: Bump github.com/ossf/scorecard/v4 from v4.10.5 to v4.11.0 by <a href="https://github.com/spencerschrock"><code>@spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1192">ossf/scorecard-action#1192</a></li> 23 </ul> 24 <h2>Scorecard Result Viewer</h2> 25 <p>Thanks to contributions from <a href="https://github.com/cynthia-sg"><code>@cynthia-sg</code></a> and <a href="https://github.com/tegioz"><code>@tegioz</code></a> at <a href="https://github.com/cncf/clomonitor">CLOMonitor</a>, there is a new Scorecard Result visualization page at <code>https://securityscorecards.dev/viewer/?uri=<project-url></code>.</p> 26 <ul> 27 <li><a href="https://redirect.github.com/ossf/scorecard-webapp/pull/406">ossf/scorecard-webapp#406</a></li> 28 <li><a href="https://redirect.github.com/ossf/scorecard-webapp/pull/422">ossf/scorecard-webapp#422</a></li> 29 </ul> 30 <p>As an example, you can see our own score visualized <a href="https://securityscorecards.dev/viewer/?uri=github.com/ossf/scorecard">here</a> 31 Checkout our <a href="https://github.com/ossf/scorecard-action/blob/08b4669551908b1024bb425080c797723083c031/README.md#scorecard-badge">README</a> to learn how to link your README badge to the new visualization page.</p> 32 <h2>Publishing Results</h2> 33 <p>This release contains two fixes which will improve the user experience when <code>publish_results</code> is <code>true</code></p> 34 <ul> 35 <li>Runs that fail our <a href="https://github.com/ossf/scorecard-action/blob/08b4669551908b1024bb425080c797723083c031/README.md#workflow-restrictions">workflow restrictions</a> will fail with a 400 response indicating the problem, instead of a vague 500 status. (<a href="https://redirect.github.com/ossf/scorecard-action/pull/1156">ossf/scorecard-action#1156</a>, resolved <a href="https://redirect.github.com/ossf/scorecard-action/issues/1150">ossf/scorecard-action#1150</a>)</li> 36 <li>Scorecard action will retry when signing results and submitting them to our web API. This should help with flakiness from connection failures. (<a href="https://redirect.github.com/ossf/scorecard-action/pull/1191">ossf/scorecard-action#1191</a>)</li> 37 </ul> 38 <h2>Docs</h2> 39 <ul> 40 <li>📖 Update README to accept fine-grained tokens by <a href="https://github.com/pnacht"><code>@pnacht</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1175">ossf/scorecard-action#1175</a></li> 41 <li>📖 Update installation instructions to match current GitHub UI by <a href="https://github.com/joycebrum"><code>@joycebrum</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1153">ossf/scorecard-action#1153</a></li> 42 <li>📖 Document the GitHub action workflow restrictions when publishing results. by <a href="https://github.com/spencerschrock"><code>@spencerschrock</code></a> in</li> 43 </ul> 44 <h2>New Contributors</h2> 45 <ul> 46 <li><a href="https://github.com/bobcallaway"><code>@bobcallaway</code></a> made their first contribution in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1140">ossf/scorecard-action#1140</a></li> 47 <li><a href="https://github.com/pnacht"><code>@pnacht</code></a> made their first contribution in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1175">ossf/scorecard-action#1175</a></li> 48 </ul> 49 <p><strong>Full Changelog</strong>: <a href="https://github.com/ossf/scorecard-action/compare/v2.1.3...v2.2.0">https://github.com/ossf/scorecard-action/compare/v2.1.3...v2.2.0</a></p> 50 <h2>v2.1.3</h2> 51 <h2>What's Changed</h2> 52 <ul> 53 <li>🌱 Bump github.com/ossf/scorecard/v4 from 4.10.2 to 4.10.5 by <a href="https://github.com/spencerschrock"><code>@spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1111">ossf/scorecard-action#1111</a></li> 54 </ul> 55 <h3>Bug Fixes</h3> 56 <ul> 57 <li>Invalid SARIF files from a bug in scorecard 58 <ul> 59 <li><a href="https://redirect.github.com/ossf/scorecard-action/issues/1076">#1076</a>, <a href="https://redirect.github.com/ossf/scorecard-action/issues/1094">#1094</a></li> 60 </ul> 61 </li> 62 <li>Vulnerabilities check crashes if a vulnerable dependency is found via OSVScanner 63 <ul> 64 <li><a href="https://redirect.github.com/ossf/scorecard-action/issues/1092">#1092</a></li> 65 </ul> 66 </li> 67 <li>Scorecard action not reporting binary artifacts in the repo 68 <ul> 69 <li><a href="https://redirect.github.com/ossf/scorecard-action/issues/1116">#1116</a></li> 70 </ul> 71 </li> 72 </ul> 73 <p><strong>Full Scorecard Changelog</strong>: <a href="https://github.com/ossf/scorecard/compare/v4.10.2...v4.10.5">https://github.com/ossf/scorecard/compare/v4.10.2...v4.10.5</a></p> 74 <p><strong>Full Changelog</strong>: <a href="https://github.com/ossf/scorecard-action/compare/v2.1.2...v2.1.3">https://github.com/ossf/scorecard-action/compare/v2.1.2...v2.1.3</a></p> 75 <h2>v2.1.2</h2> 76 <h2>What's Changed</h2> 77 <h3>Fixes</h3> 78 <!-- raw HTML omitted --> 79 </blockquote> 80 <p>... (truncated)</p> 81 </details> 82 <details> 83 <summary>Commits</summary> 84 <ul> 85 <li><a href="https://github.com/ossf/scorecard-action/commit/08b4669551908b1024bb425080c797723083c031"><code>08b4669</code></a> :seedling: Bump docker tag to for v2.2.0 release. (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1194">#1194</a>)</li> 86 <li><a href="https://github.com/ossf/scorecard-action/commit/3c7470f58c4371d8ac58beaeeacf771227d63ce8"><code>3c7470f</code></a> :book: Update README badge link to use new uri param. (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1185">#1185</a>)</li> 87 <li><a href="https://github.com/ossf/scorecard-action/commit/a164dbc12a66d9fae8ec379fff6ba200da366366"><code>a164dbc</code></a> :seedling: Bump github.com/ossf/scorecard/v4 from v4.10.5 to v4.11.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1192">#1192</a>)</li> 88 <li><a href="https://github.com/ossf/scorecard-action/commit/597960e1d95e5c741af238a819f03655e2fa43b8"><code>597960e</code></a> :book: Update README to accept fine-grained tokens (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1175">#1175</a>)</li> 89 <li><a href="https://github.com/ossf/scorecard-action/commit/8808ed28c3b8ba5a7d8059bd0360d8374ff6adb3"><code>8808ed2</code></a> :seedling: Retry external network calls when publishing results (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1191">#1191</a>)</li> 90 <li><a href="https://github.com/ossf/scorecard-action/commit/0eed6cb5da014387b234df059cd4a2db5dbe9e1f"><code>0eed6cb</code></a> :seedling: Bump golang.org/x/net from 0.10.0 to 0.11.0</li> 91 <li><a href="https://github.com/ossf/scorecard-action/commit/6c6335c126308fd03da1c3bb267c1ebc3a34db0c"><code>6c6335c</code></a> :seedling: Bump github/codeql-action from 2.3.6 to 2.20.0</li> 92 <li><a href="https://github.com/ossf/scorecard-action/commit/7f1baf380a4f4418b4864d5a57bee1beba03e2eb"><code>7f1baf3</code></a> :book: Switch recommended badge link to the new viewer. (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1176">#1176</a>)</li> 93 <li><a href="https://github.com/ossf/scorecard-action/commit/df98bbc13d1c3001cc90b8a2791ffde7ba29f061"><code>df98bbc</code></a> :seedling: Bump actions/checkout from 3.5.2 to 3.5.3</li> 94 <li><a href="https://github.com/ossf/scorecard-action/commit/75886d414a5cd048874360697f1e8edb5b1e55ca"><code>75886d4</code></a> :seedling: Bump golangci/golangci-lint-action from 3.5.0 to 3.6.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1172">#1172</a>)</li> 95 <li>Additional commits viewable in <a href="https://github.com/ossf/scorecard-action/compare/c1aec4ac820532bab364f02a81873c555a0ba3a1...08b4669551908b1024bb425080c797723083c031">compare view</a></li> 96 </ul> 97 </details> 98 <br /> 99 100 101 [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) 102 103 Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. 104 105 [//]: # (dependabot-automerge-start) 106 [//]: # (dependabot-automerge-end) 107 108 --- 109 110 <details> 111 <summary>Dependabot commands and options</summary> 112 <br /> 113 114 You can trigger Dependabot actions by commenting on this PR: 115 - `@dependabot rebase` will rebase this PR 116 - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it 117 - `@dependabot merge` will merge this PR after your CI passes on it 118 - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it 119 - `@dependabot cancel merge` will cancel a previously requested merge and block automerging 120 - `@dependabot reopen` will reopen this PR if it is closed 121 - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually 122 - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) 123 - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) 124 - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) 125 126 127 </details> 128 129 <!-- Replace --> 130 ---- 131 ⌛ Deploy Preview - Build in Progress 132 <!-- Replace --> 133 134