Sourced fromossf/scorecard-action's releases.

v2.4.1

What's Changed

• This update bumps the Scorecard version to the v5.1.1 release. For a complete list of changes, please refer to thev5.1.0 andv5.1.1 release notes.
• Publishing results now uses half the API quota as before. The exact savings depends on the repository in question.
  • use Scorecard library entrypoint instead of Cobra hooking by@​spencerschrock inossf/scorecard-action#1423
• Some errors were made into annotations to make them more visible
  • Make default branch error more prominent by@​jsoref inossf/scorecard-action#1459
• There is now an optionalfile_mode input which controls how repository files are fetched from GitHub. The default isarchive, butgit produces the most accurate results for repositories with.gitattributes files at the cost of analysis speed.
  • add input for specifying--file-mode by@​spencerschrock inossf/scorecard-action#1509
• The underlying container for the action is nowhosted on GitHub Container Registry. There should be no functional changes.
  • 🌱 publish docker images to GitHub Container Registry by@​spencerschrock inossf/scorecard-action#1453

Docs

• Installation docs update by@​JeremiahAHoward inossf/scorecard-action#1416

New Contributors

• @​JeremiahAHoward made their first contribution inossf/scorecard-action#1416
• @​jsoref made their first contribution inossf/scorecard-action#1459Full Changelog:ossf/scorecard-action@v2.4.0...v2.4.1

• f49aabe bump docker to ghcr v2.4.1 (#1478)
• 30a595b 🌱 Bump github.com/sigstore/cosign/v2 from 2.4.2 to 2.4.3 (#1515)
• 69ae593 omit vcs info from build (#1514)
• 6a62a1c add input for specifying--file-mode (#1509)
• 2722664 🌱 Bump the github-actions group with 2 updates (#1510)
• ae0ef31 🌱 Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 (#1512)
• 3676bbc 🌱 Bump golang from 1.23.6 to 1.24.0 in the docker-images group (#1513)
• ae7548a Limit codeQL push trigger to main branch (#1507)
• 9165624 upgrade scorecard to v5.1.0 (#1508)
• 620fd28 🌱 Bump the github-actions group with 2 updates (#1505)
• Additional commits viewable incompare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)