Bumps the github-actions group with 7 updates:| Package | From | To || --- | --- | --- || [actions/cache](https://github.com/actions/cache) | `4.2.0` | `4.2.1`|| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.29.7` |`1.29.9` || [azure/setup-helm](https://github.com/azure/setup-helm) | `4.2.0` |`4.3.0` || [actions/upload-artifact](https://github.com/actions/upload-artifact)| `4.6.0` | `4.6.1` || [fluxcd/flux2](https://github.com/fluxcd/flux2) | `2.4.0` | `2.5.0` || [ossf/scorecard-action](https://github.com/ossf/scorecard-action) |`2.4.0` | `2.4.1` || [github/codeql-action](https://github.com/github/codeql-action) |`3.28.9` | `3.28.10` |Updates `actions/cache` from 4.2.0 to 4.2.1<details><summary>Release notes</summary><p><em>Sourced from <ahref="https://github.com/actions/cache/releases">actions/cache'sreleases</a>.</em></p><blockquote><h2>v4.2.1</h2><h2>What's Changed</h2><blockquote><p>[!IMPORTANT]As a reminder, there were important backend changes to release v4.2.0,see <a href="https://github.com/actions/cache/releases/tag/v4.2.0">thoserelease notes</a> and <ahref="https://github.com/actions/cache/discussions/1510">theannouncement</a> for more details.</p></blockquote><ul><li>docs: GitHub is spelled incorrectly in caching-strategies.md by <ahref="https://github.com/janco-absa"><code>@​janco-absa</code></a> in <ahref="https://redirect.github.com/actions/cache/pull/1526">actions/cache#1526</a></li><li>docs: Make the &quot;always save prime numbers&quot; example moreclear by <a href="https://github.com/Tobbe"><code>@​Tobbe</code></a> in<ahref="https://redirect.github.com/actions/cache/pull/1525">actions/cache#1525</a></li><li>Update force deletion docs due a recent deprecation by <ahref="https://github.com/sebbalex"><code>@​sebbalex</code></a> in <ahref="https://redirect.github.com/actions/cache/pull/1500">actions/cache#1500</a></li><li>Bump <code>@​actions/cache</code> to v4.0.1 by <ahref="https://github.com/robherley"><code>@​robherley</code></a> in <ahref="https://redirect.github.com/actions/cache/pull/1554">actions/cache#1554</a></li></ul><h2>New Contributors</h2><ul><li><ahref="https://github.com/janco-absa"><code>@​janco-absa</code></a> madetheir first contribution in <ahref="https://redirect.github.com/actions/cache/pull/1526">actions/cache#1526</a></li><li><a href="https://github.com/Tobbe"><code>@​Tobbe</code></a> madetheir first contribution in <ahref="https://redirect.github.com/actions/cache/pull/1525">actions/cache#1525</a></li><li><a href="https://github.com/sebbalex"><code>@​sebbalex</code></a>made their first contribution in <ahref="https://redirect.github.com/actions/cache/pull/1500">actions/cache#1500</a></li></ul><p><strong>Full Changelog</strong>: <ahref="https://github.com/actions/cache/compare/v4.2.0...v4.2.1">https://github.com/actions/cache/compare/v4.2.0...v4.2.1</a></p></blockquote></details><details><summary>Changelog</summary><p><em>Sourced from <ahref="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache'schangelog</a>.</em></p><blockquote><h1>Releases</h1><h3>4.2.1</h3><ul><li>Bump <code>@actions/cache</code> to v4.0.1</li></ul><h3>4.2.0</h3><p>TLDR; The cache backend service has been rewritten from the ground upfor improved performance and reliability. <ahref="https://github.com/actions/cache">actions/cache</a> now integrateswith the new cache service (v2) APIs.</p><p>The new service will gradually roll out as of <strong>February 1st,2025</strong>. The legacy service will also be sunset on the same date.Changes in these release are <strong>fully backwardcompatible</strong>.</p><p><strong>We are deprecating some versions of this action</strong>. Werecommend upgrading to version <code>v4</code> or <code>v3</code> assoon as possible before <strong>February 1st, 2025.</strong> (Upgradeinstructions below).</p><p>If you are using pinned SHAs, please use the SHAs of versions<code>v4.2.0</code> or <code>v3.4.0</code></p><p>If you do not upgrade, all workflow runs using any of the deprecated<a href="https://github.com/actions/cache">actions/cache</a> willfail.</p><p>Upgrading to the recommended versions will not break yourworkflows.</p><h3>4.1.2</h3><ul><li>Add GitHub Enterprise Cloud instances hostname filters to inform APIendpoint choices - <ahref="https://redirect.github.com/actions/cache/pull/1474">#1474</a></li><li>Security fix: Bump braces from 3.0.2 to 3.0.3 - <ahref="https://redirect.github.com/actions/cache/pull/1475">#1475</a></li></ul><h3>4.1.1</h3><ul><li>Restore original behavior of <code>cache-hit</code> output - <ahref="https://redirect.github.com/actions/cache/pull/1467">#1467</a></li></ul><h3>4.1.0</h3><ul><li>Ensure <code>cache-hit</code> output is set when a cache is missed -<ahref="https://redirect.github.com/actions/cache/pull/1404">#1404</a></li><li>Deprecate <code>save-always</code> input - <ahref="https://redirect.github.com/actions/cache/pull/1452">#1452</a></li></ul><h3>4.0.2</h3><ul><li>Fixed restore <code>fail-on-cache-miss</code> not working.</li></ul><h3>4.0.1</h3><ul><li>Updated <code>isGhes</code> check</li></ul><h3>4.0.0</h3><ul><li>Updated minimum runner version support from node 12 -&gt; node20</li></ul><h3>3.4.0</h3><ul><li>Integrated with the new cache service (v2) APIs</li></ul><!-- raw HTML omitted --></blockquote><p>... (truncated)</p></details><details><summary>Commits</summary><ul><li><ahref="https://github.com/actions/cache/commit/0c907a75c2c80ebcb7f088228285e798b750cf8f"><code>0c907a7</code></a>Merge pull request <ahref="https://redirect.github.com/actions/cache/issues/1554">#1554</a>from actions/robherley/v4.2.1</li><li><ahref="https://github.com/actions/cache/commit/710893c2369beb60748049b671f18c43a3656fce"><code>710893c</code></a>bump <code>@​actions/cache</code> to v4.0.1</li><li><ahref="https://github.com/actions/cache/commit/9fa7e61ec7e1f44ac75218e7aaea81da8856fd11"><code>9fa7e61</code></a>Update force deletion docs due a recent deprecation (<ahref="https://redirect.github.com/actions/cache/issues/1500">#1500</a>)</li><li><ahref="https://github.com/actions/cache/commit/36f1e144e1c8edb0a652766b484448563d8baf46"><code>36f1e14</code></a>docs: Make the &quot;always save prime numbers&quot; example more clear(<ahref="https://redirect.github.com/actions/cache/issues/1525">#1525</a>)</li><li><ahref="https://github.com/actions/cache/commit/53aa38c736a561b9c17b62df3fe885a17b78ee6d"><code>53aa38c</code></a>Correct GitHub Spelling in caching-strategies.md (<ahref="https://redirect.github.com/actions/cache/issues/1526">#1526</a>)</li><li>See full diff in <ahref="https://github.com/actions/cache/compare/1bd1e32a3bdc45362d1e726936510720a7c30a57...0c907a75c2c80ebcb7f088228285e798b750cf8f">compareview</a></li></ul></details><br />Updates `crate-ci/typos` from 1.29.7 to 1.29.9<details><summary>Release notes</summary><p><em>Sourced from <ahref="https://github.com/crate-ci/typos/releases">crate-ci/typos'sreleases</a>.</em></p><blockquote><h2>v1.29.9</h2><h2>[1.29.9] - 2025-02-20</h2><h3>Fixes</h3><ul><li><em>(action)</em> Correctly get binary for some aarch64 systems</li></ul><h2>v1.29.8</h2><h2>[1.29.8] - 2025-02-19</h2><h3>Features</h3><ul><li>Attempt to build Linux aarch64 binaries</li></ul></blockquote></details><details><summary>Changelog</summary><p><em>Sourced from <ahref="https://github.com/crate-ci/typos/blob/master/CHANGELOG.md">crate-ci/typos'schangelog</a>.</em></p><blockquote><h1>Change Log</h1><p>All notable changes to this project will be documented in thisfile.</p><p>The format is based on <a href="http://keepachangelog.com/">Keep aChangelog</a>and this project adheres to <a href="http://semver.org/">SemanticVersioning</a>.</p><!-- raw HTML omitted --><h2>[Unreleased] - ReleaseDate</h2><h2>[1.29.9] - 2025-02-20</h2><h3>Fixes</h3><ul><li><em>(action)</em> Correctly get binary for some aarch64 systems</li></ul><h2>[1.29.8] - 2025-02-19</h2><h3>Features</h3><ul><li>Attempt to build Linux aarch64 binaries</li></ul><h2>[1.29.7] - 2025-02-13</h2><h3>Fixes</h3><ul><li>Don't correct <code>implementors</code></li></ul><h2>[1.29.6] - 2025-02-13</h2><h3>Features</h3><ul><li>Updated the dictionary with the <ahref="https://redirect.github.com/crate-ci/typos/issues/1200">January2025</a> changes</li></ul><h2>[1.29.5] - 2025-01-30</h2><h3>Internal</h3><ul><li>Update a dependency</li></ul><h2>[1.29.4] - 2025-01-03</h2><h2>[1.29.3] - 2025-01-02</h2><h2>[1.29.2] - 2025-01-02</h2><h2>[1.29.1] - 2025-01-02</h2><h3>Fixes</h3><ul><li>Don't correct <code>deriver</code></li></ul><!-- raw HTML omitted --></blockquote><p>... (truncated)</p></details><details><summary>Commits</summary><ul><li><ahref="https://github.com/crate-ci/typos/commit/212923e4ff05b7fc2294a204405eec047b807138"><code>212923e</code></a>chore: Release</li><li><ahref="https://github.com/crate-ci/typos/commit/659bf5525349fd206cd1678999f83d18de56aff1"><code>659bf55</code></a>docs: Update changelog</li><li><ahref="https://github.com/crate-ci/typos/commit/092b7056bbee0592fb00c370409b891f458a6e08"><code>092b705</code></a>Merge pull request <ahref="https://redirect.github.com/crate-ci/typos/issues/1239">#1239</a>from codingskynet/fix/support-aarch64</li><li><ahref="https://github.com/crate-ci/typos/commit/298a143ed0001bf83403a9ac2acd9d97bf90fb8c"><code>298a143</code></a>chore(gh): Fix links</li><li><ahref="https://github.com/crate-ci/typos/commit/d7059d7796bd95ed84d7371925404ada3ef367b2"><code>d7059d7</code></a>chore(gh): Fix links</li><li><ahref="https://github.com/crate-ci/typos/commit/636d59beef47e4c8c75497423a853bc830349dcf"><code>636d59b</code></a>chore(gh): Encourage people to check for dupes</li><li><ahref="https://github.com/crate-ci/typos/commit/51cd88f328acb0b208a232c5cbccb83de6ac8188"><code>51cd88f</code></a>chore(gh): Add a data template</li><li><ahref="https://github.com/crate-ci/typos/commit/c11cf6c0e1b424b62965a1370ec9926a0266dfb1"><code>c11cf6c</code></a>chore(gh): Try to clarify template</li><li><ahref="https://github.com/crate-ci/typos/commit/3bcb9191487d04efb8260b9753e6f62262199265"><code>3bcb919</code></a>fix: add aarch64 on arm64 cond</li><li><ahref="https://github.com/crate-ci/typos/commit/1ea66fdf4d62b5a980bff2c47e0be131365bfcf2"><code>1ea66fd</code></a>docs(readme): Call out that the readme is not exhaustive</li><li>Additional commits viewable in <ahref="https://github.com/crate-ci/typos/compare/51f257b946f503b768e522781f56e9b7b5570d48...212923e4ff05b7fc2294a204405eec047b807138">compareview</a></li></ul></details><br />Updates `azure/setup-helm` from 4.2.0 to 4.3.0<details><summary>Release notes</summary><p><em>Sourced from <ahref="https://github.com/azure/setup-helm/releases">azure/setup-helm'sreleases</a>.</em></p><blockquote><h2>v4.3.0</h2><ul><li><ahref="https://redirect.github.com/azure/setup-helm/issues/152">#152</a>feat: log when restoring from cache</li><li><ahref="https://redirect.github.com/azure/setup-helm/issues/157">#157</a>Dependencies Update</li><li><ahref="https://redirect.github.com/azure/setup-helm/issues/137">#137</a>Add dependabot</li></ul></blockquote></details><details><summary>Changelog</summary><p><em>Sourced from <ahref="https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md">azure/setup-helm'schangelog</a>.</em></p><blockquote><h1>Change Log</h1><h2>[4.3.0] - 2025-02-15</h2><ul><li><ahref="https://redirect.github.com/azure/setup-helm/issues/152">#152</a>feat: log when restoring from cache</li><li><ahref="https://redirect.github.com/azure/setup-helm/issues/157">#157</a>Dependencies Update</li><li><ahref="https://redirect.github.com/azure/setup-helm/issues/137">#137</a>Add dependabot</li></ul><h2>[4.2.0] - 2024-04-15</h2><ul><li><ahref="https://redirect.github.com/azure/setup-helm/issues/124">#124</a>Fix OS detection and download OS-native archive extension</li></ul><h2>[4.1.0] - 2024-03-01</h2><ul><li><ahref="https://redirect.github.com/azure/setup-helm/issues/130">#130</a>switches to use Helm published file to read latest version instead ofusing GitHub releases</li></ul><h2>[4.0.0] - 2024-02-12</h2><ul><li><ahref="https://redirect.github.com/azure/setup-helm/issues/121">#121</a>update to node20 as node16 is deprecated</li></ul></blockquote></details><details><summary>Commits</summary><ul><li><ahref="https://github.com/Azure/setup-helm/commit/b9e51907a09c216f16ebe8536097933489208112"><code>b9e5190</code></a>build</li><li><ahref="https://github.com/Azure/setup-helm/commit/0e8654bb94582592935dc70ca0438926cea61865"><code>0e8654b</code></a>Release setup-helm version 4.3.0 (<ahref="https://redirect.github.com/azure/setup-helm/issues/162">#162</a>)</li><li><ahref="https://github.com/Azure/setup-helm/commit/b48e1dfac1cac293240bf5ea8d7054a228769739"><code>b48e1df</code></a>feat: log when restoring from cache (<ahref="https://redirect.github.com/azure/setup-helm/issues/152">#152</a>)</li><li><ahref="https://github.com/Azure/setup-helm/commit/855ae7a03c297d33ee0f6e0959cfc87f4ba7ee0c"><code>855ae7a</code></a>Bump the actions group across 1 directory with 3 updates (<ahref="https://redirect.github.com/azure/setup-helm/issues/159">#159</a>)</li><li><ahref="https://github.com/Azure/setup-helm/commit/124c6d88e7a75334a4fad6d0905089d6d714d088"><code>124c6d8</code></a>Dependencies Update (<ahref="https://redirect.github.com/azure/setup-helm/issues/157">#157</a>)</li><li><ahref="https://github.com/Azure/setup-helm/commit/048f4e7eae1192e88a86787d033f837a2aa27d4c"><code>048f4e7</code></a>Bump the actions group across 1 directory with 2 updates (<ahref="https://redirect.github.com/azure/setup-helm/issues/151">#151</a>)</li><li><ahref="https://github.com/Azure/setup-helm/commit/8618769467d74e09809f09197c6fb7ca9f50d5ae"><code>8618769</code></a>Bump the actions group across 1 directory with 4 updates (<ahref="https://redirect.github.com/azure/setup-helm/issues/149">#149</a>)</li><li><ahref="https://github.com/Azure/setup-helm/commit/4eb898eef0f80e48f43929d83a1db3b30e766a1f"><code>4eb898e</code></a>Bump the actions group across 1 directory with 2 updates (<ahref="https://redirect.github.com/azure/setup-helm/issues/145">#145</a>)</li><li><ahref="https://github.com/Azure/setup-helm/commit/7a2001c0f6ca6db9afce16d84b88c7307ed9a707"><code>7a2001c</code></a>Bump the actions group across 1 directory with 2 updates (<ahref="https://redirect.github.com/azure/setup-helm/issues/143">#143</a>)</li><li><ahref="https://github.com/Azure/setup-helm/commit/e90c86ceeaceb8a9de7d8225d29b43fa620e3709"><code>e90c86c</code></a>Bump the actions group across 1 directory with 9 updates (<ahref="https://redirect.github.com/azure/setup-helm/issues/141">#141</a>)</li><li>Additional commits viewable in <ahref="https://github.com/azure/setup-helm/compare/fe7b79cd5ee1e45176fcad797de68ecaf3ca4814...b9e51907a09c216f16ebe8536097933489208112">compareview</a></li></ul></details><br />Updates `actions/upload-artifact` from 4.6.0 to 4.6.1<details><summary>Release notes</summary><p><em>Sourced from <ahref="https://github.com/actions/upload-artifact/releases">actions/upload-artifact'sreleases</a>.</em></p><blockquote><h2>v4.6.1</h2><h2>What's Changed</h2><ul><li>Update to use artifact 2.2.2 package by <ahref="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <ahref="https://redirect.github.com/actions/upload-artifact/pull/673">actions/upload-artifact#673</a></li></ul><p><strong>Full Changelog</strong>: <ahref="https://github.com/actions/upload-artifact/compare/v4...v4.6.1">https://github.com/actions/upload-artifact/compare/v4...v4.6.1</a></p></blockquote></details><details><summary>Commits</summary><ul><li><ahref="https://github.com/actions/upload-artifact/commit/4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1"><code>4cec3d8</code></a>Merge pull request <ahref="https://redirect.github.com/actions/upload-artifact/issues/673">#673</a>from actions/yacaovsnc/artifact_2.2.2</li><li><ahref="https://github.com/actions/upload-artifact/commit/e9fad966ccdffceea5de0445882c9455934bcf8e"><code>e9fad96</code></a>license cache update for artifact</li><li><ahref="https://github.com/actions/upload-artifact/commit/b26fd06e9da88a61ada55f23d7863325b1f115d3"><code>b26fd06</code></a>Update to use artifact 2.2.2 package</li><li>See full diff in <ahref="https://github.com/actions/upload-artifact/compare/65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08...4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1">compareview</a></li></ul></details><br />Updates `fluxcd/flux2` from 2.4.0 to 2.5.0<details><summary>Release notes</summary><p><em>Sourced from <ahref="https://github.com/fluxcd/flux2/releases">fluxcd/flux2'sreleases</a>.</em></p><blockquote><h2>v2.5.0</h2><h2>Highlights</h2><p>Flux v2.5.0 is a feature release. Users are encouraged to upgrade forthe best experience.</p><p>For a compressive overview of new features and API changes includedin this release,please refer to the <ahref="https://fluxcd.io/blog/2025/02/flux-v2.5.0/">Announcing Flux 2.5GA blog post</a>.</p><p>Overview of the new features:</p><ul><li>Support for GitHub App authentication (<code>GitRepository</code>and <code>ImageUpdateAutomation</code> API)</li><li>Custom Health Checks using CEL (<code>Kustomization</code> API)</li><li>Fine-grained control of garbage collection(<code>Kustomization</code> API)</li><li>Enable decryption of secrets generated by Kustomize components(<code>Kustomization</code> API)</li><li>Support for custom event metadata from annotations(<code>Alert</code> API)</li><li>Git commit status updates for Flux Kustomizations with OCIRepositorysources (<code>Alert</code> API)</li><li>Resource filtering using CEL for webhook receivers(<code>Receiver</code> API)</li><li>Debug commands for Flux Kustomizations and HelmReleases (FluxCLI)</li></ul><p>❤️ Big thanks to all the Flux contributors that helped us with thisrelease!</p><h3>Kubernetes compatibility</h3><p>This release is compatible with the following Kubernetesversions:</p><table><thead><tr><th>Kubernetes version</th><th>Minimum required</th></tr></thead><tbody><tr><td><code>v1.30</code></td><td><code>&gt;= 1.30.0</code></td></tr><tr><td><code>v1.31</code></td><td><code>&gt;= 1.31.0</code></td></tr><tr><td><code>v1.32</code></td><td><code>&gt;= 1.32.0</code></td></tr></tbody></table><blockquote><p>[!NOTE]Note that the Flux project offers support only for the latest threeminor versions of Kubernetes.Backwards compatibility with older versions of Kubernetes and OpenShiftis offered by vendors such as<ahref="https://control-plane.io/enterprise-for-flux-cd/">ControlPlane</a>that provide enterprise support for Flux.</p></blockquote><h3>OpenShift compatibility</h3><p>Flux can be installed on Red Hat OpenShift cluster directly fromOperatorHub using<a href="https://operatorhub.io/operator/flux-operator">FluxOperator</a>.The operator allows the configuration of Flux multi-tenancy lockdown,network policies,persistent storage, sharding, vertical scaling and the synchronizationof the cluster state from Git repositories, OCI artifacts andS3-compatible storage.</p><h2>Upgrade procedure</h2><p>Upgrade Flux from <code>v2.4.0</code> to <code>v2.5.0</code> byfollowing the <ahref="https://fluxcd.io/flux/installation/upgrade/">upgradeguide</a>.</p><p>There are no new API versions in this release, so no changes arerequired in the YAML manifests containing Flux resources.</p><!-- raw HTML omitted --></blockquote><p>... (truncated)</p></details><details><summary>Commits</summary><ul><li><ahref="https://github.com/fluxcd/flux2/commit/af67405ee43a6cd66e0b73f4b3802e8583f9d961"><code>af67405</code></a>Merge pull request <ahref="https://redirect.github.com/fluxcd/flux2/issues/5204">#5204</a>from fluxcd/kubectl-1.32.2</li><li><ahref="https://github.com/fluxcd/flux2/commit/6f65c92fe7f335ba965d743ffb6d53c0b3470779"><code>6f65c92</code></a>Update kubectl in flux-cli image</li><li><ahref="https://github.com/fluxcd/flux2/commit/c84d3122890a05491ce9ef6215e5b1dfb741cc99"><code>c84d312</code></a>Merge pull request <ahref="https://redirect.github.com/fluxcd/flux2/issues/5203">#5203</a>from fluxcd/fix-cli-build</li><li><ahref="https://github.com/fluxcd/flux2/commit/d37473ff4469cb62f2b5c8fe142209be624c9afc"><code>d37473f</code></a>Update flux-cli image</li><li><ahref="https://github.com/fluxcd/flux2/commit/712b03727ae48f9366b80af783f334b2f5d7d919"><code>712b037</code></a>Merge pull request <ahref="https://redirect.github.com/fluxcd/flux2/issues/5200">#5200</a>from fluxcd/update-k8s-check</li><li><ahref="https://github.com/fluxcd/flux2/commit/14da7d58be2f61eac70e206bfa040707676354e6"><code>14da7d5</code></a>Update Kubernetes min supported version to 1.30</li><li><ahref="https://github.com/fluxcd/flux2/commit/45da6a86f84e1a6839afbbf723c11c8548911764"><code>45da6a8</code></a>Merge pull request <ahref="https://redirect.github.com/fluxcd/flux2/issues/5199">#5199</a>from fluxcd/tests-2.5</li><li><ahref="https://github.com/fluxcd/flux2/commit/3053a0b8405545b406bab8b27d3aac252c92374c"><code>3053a0b</code></a>Update integration tests dependencies for Flux 2.5</li><li><ahref="https://github.com/fluxcd/flux2/commit/96f95b6b4c9c9dc3b9e02f1045f756093f36630c"><code>96f95b6</code></a>Merge pull request <ahref="https://redirect.github.com/fluxcd/flux2/issues/5195">#5195</a>from fluxcd/update-components</li><li><ahref="https://github.com/fluxcd/flux2/commit/cf92e02f531dede408ba81add5adcaf7ae8d7e70"><code>cf92e02</code></a>Update toolkit components</li><li>Additional commits viewable in <ahref="https://github.com/fluxcd/flux2/compare/5350425cdcd5fa015337e09fa502153c0275bd4b...af67405ee43a6cd66e0b73f4b3802e8583f9d961">compareview</a></li></ul></details><br />Updates `ossf/scorecard-action` from 2.4.0 to 2.4.1<details><summary>Release notes</summary><p><em>Sourced from <ahref="https://github.com/ossf/scorecard-action/releases">ossf/scorecard-action'sreleases</a>.</em></p><blockquote><h2>v2.4.1</h2><h2>What's Changed</h2><ul><li>This update bumps the Scorecard version to the v5.1.1 release. For acomplete list of changes, please refer to the <ahref="https://github.com/ossf/scorecard/releases/tag/v5.1.0">v5.1.0</a>and <ahref="https://github.com/ossf/scorecard/releases/tag/v5.1.1">v5.1.1</a>release notes.</li><li>Publishing results now uses half the API quota as before. The exactsavings depends on the repository in question.<ul><li>use Scorecard library entrypoint instead of Cobra hooking by <ahref="https://github.com/spencerschrock"><code>@​spencerschrock</code></a>in <ahref="https://redirect.github.com/ossf/scorecard-action/pull/1423">ossf/scorecard-action#1423</a></li></ul></li><li>Some errors were made into annotations to make them more visible<ul><li>Make default branch error more prominent by <ahref="https://github.com/jsoref"><code>@​jsoref</code></a> in <ahref="https://redirect.github.com/ossf/scorecard-action/pull/1459">ossf/scorecard-action#1459</a></li></ul></li><li>There is now an optional <code>file_mode</code> input which controlshow repository files are fetched from GitHub. The default is<code>archive</code>, but <code>git</code> produces the most accurateresults for repositories with <code>.gitattributes</code> files at thecost of analysis speed.<ul><li>add input for specifying <code>--file-mode</code> by <ahref="https://github.com/spencerschrock"><code>@​spencerschrock</code></a>in <ahref="https://redirect.github.com/ossf/scorecard-action/pull/1509">ossf/scorecard-action#1509</a></li></ul></li><li>The underlying container for the action is now <ahref="https://github.com/ossf/scorecard-action/pkgs/container/scorecard-action">hostedon GitHub Container Registry</a>. There should be no functional changes.<ul><li>:seedling: publish docker images to GitHub Container Registry by <ahref="https://github.com/spencerschrock"><code>@​spencerschrock</code></a>in <ahref="https://redirect.github.com/ossf/scorecard-action/pull/1453">ossf/scorecard-action#1453</a></li></ul></li></ul><h3>Docs</h3><ul><li>Installation docs update by <ahref="https://github.com/JeremiahAHoward"><code>@​JeremiahAHoward</code></a>in <ahref="https://redirect.github.com/ossf/scorecard-action/pull/1416">ossf/scorecard-action#1416</a></li></ul><h2>New Contributors</h2><ul><li><ahref="https://github.com/JeremiahAHoward"><code>@​JeremiahAHoward</code></a>made their first contribution in <ahref="https://redirect.github.com/ossf/scorecard-action/pull/1416">ossf/scorecard-action#1416</a></li><li><a href="https://github.com/jsoref"><code>@​jsoref</code></a> madetheir first contribution in <ahref="https://redirect.github.com/ossf/scorecard-action/pull/1459">ossf/scorecard-action#1459</a><strong>Full Changelog</strong>: <ahref="https://github.com/ossf/scorecard-action/compare/v2.4.0...v2.4.1">https://github.com/ossf/scorecard-action/compare/v2.4.0...v2.4.1</a></li></ul></blockquote></details><details><summary>Commits</summary><ul><li><ahref="https://github.com/ossf/scorecard-action/commit/f49aabe0b5af0936a0987cfb85d86b75731b0186"><code>f49aabe</code></a>bump docker to ghcr v2.4.1 (<ahref="https://redirect.github.com/ossf/scorecard-action/issues/1478">#1478</a>)</li><li><ahref="https://github.com/ossf/scorecard-action/commit/30a595ba8670f7bd5e2d33119dfeeb6ab2f64991"><code>30a595b</code></a>:seedling: Bump github.com/sigstore/cosign/v2 from 2.4.2 to 2.4.3 (<ahref="https://redirect.github.com/ossf/scorecard-action/issues/1515">#1515</a>)</li><li><ahref="https://github.com/ossf/scorecard-action/commit/69ae593b7addfd5241b46c43c7ed6abbd7203d55"><code>69ae593</code></a>omit vcs info from build (<ahref="https://redirect.github.com/ossf/scorecard-action/issues/1514">#1514</a>)</li><li><ahref="https://github.com/ossf/scorecard-action/commit/6a62a1cbf28018bd61197d0c2852b94b046fe1a4"><code>6a62a1c</code></a>add input for specifying <code>--file-mode</code> (<ahref="https://redirect.github.com/ossf/scorecard-action/issues/1509">#1509</a>)</li><li><ahref="https://github.com/ossf/scorecard-action/commit/2722664778d49161a69d42f8e82e15ed38fea8d1"><code>2722664</code></a>:seedling: Bump the github-actions group with 2 updates (<ahref="https://redirect.github.com/ossf/scorecard-action/issues/1510">#1510</a>)</li><li><ahref="https://github.com/ossf/scorecard-action/commit/ae0ef3171a81cb48c3fdaaf34cba323d0c51fefb"><code>ae0ef31</code></a>:seedling: Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 (<ahref="https://redirect.github.com/ossf/scorecard-action/issues/1512">#1512</a>)</li><li><ahref="https://github.com/ossf/scorecard-action/commit/3676bbc29082184ac34a84d1573c0419f81c4a68"><code>3676bbc</code></a>:seedling: Bump golang from 1.23.6 to 1.24.0 in the docker-images group(<ahref="https://redirect.github.com/ossf/scorecard-action/issues/1513">#1513</a>)</li><li><ahref="https://github.com/ossf/scorecard-action/commit/ae7548a0ff1b94dda3a89eeda8f59c031874f035"><code>ae7548a</code></a>Limit codeQL push trigger to main branch (<ahref="https://redirect.github.com/ossf/scorecard-action/issues/1507">#1507</a>)</li><li><ahref="https://github.com/ossf/scorecard-action/commit/9165624e75f0c73d13a9db2d4d920bcc5fc3a801"><code>9165624</code></a>upgrade scorecard to v5.1.0 (<ahref="https://redirect.github.com/ossf/scorecard-action/issues/1508">#1508</a>)</li><li><ahref="https://github.com/ossf/scorecard-action/commit/620fd28d6b2ba01c1d70cf63dfb4bdf868e19d6f"><code>620fd28</code></a>:seedling: Bump the github-actions group with 2 updates (<ahref="https://redirect.github.com/ossf/scorecard-action/issues/1505">#1505</a>)</li><li>Additional commits viewable in <ahref="https://github.com/ossf/scorecard-action/compare/62b2cac7ed8198b15735ed49ab1e5cf35480ba46...f49aabe0b5af0936a0987cfb85d86b75731b0186">compareview</a></li></ul></details><br />Updates `github/codeql-action` from 3.28.9 to 3.28.10<details><summary>Release notes</summary><p><em>Sourced from <ahref="https://github.com/github/codeql-action/releases">github/codeql-action'sreleases</a>.</em></p><blockquote><h2>v3.28.10</h2><h1>CodeQL Action Changelog</h1><p>See the <ahref="https://github.com/github/codeql-action/releases">releasespage</a> for the relevant changes to the CodeQL CLI and languagepacks.</p><h2>3.28.10 - 21 Feb 2025</h2><ul><li>Update default CodeQL bundle version to 2.20.5. <ahref="https://redirect.github.com/github/codeql-action/pull/2772">#2772</a></li><li>Address an issue where the CodeQL Bundle would occasionally fail todecompress on macOS. <ahref="https://redirect.github.com/github/codeql-action/pull/2768">#2768</a></li></ul><p>See the full <ahref="https://github.com/github/codeql-action/blob/v3.28.10/CHANGELOG.md">CHANGELOG.md</a>for more information.</p></blockquote></details><details><summary>Changelog</summary><p><em>Sourced from <ahref="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action'schangelog</a>.</em></p><blockquote><h1>CodeQL Action Changelog</h1><p>See the <ahref="https://github.com/github/codeql-action/releases">releasespage</a> for the relevant changes to the CodeQL CLI and languagepacks.</p><h2>[UNRELEASED]</h2><p>No user facing changes.</p><h2>3.28.10 - 21 Feb 2025</h2><ul><li>Update default CodeQL bundle version to 2.20.5. <ahref="https://redirect.github.com/github/codeql-action/pull/2772">#2772</a></li><li>Address an issue where the CodeQL Bundle would occasionally fail todecompress on macOS. <ahref="https://redirect.github.com/github/codeql-action/pull/2768">#2768</a></li></ul><h2>3.28.9 - 07 Feb 2025</h2><ul><li>Update default CodeQL bundle version to 2.20.4. <ahref="https://redirect.github.com/github/codeql-action/pull/2753">#2753</a></li></ul><h2>3.28.8 - 29 Jan 2025</h2><ul><li>Enable support for Kotlin 2.1.10 when running with CodeQL CLIv2.20.3. <ahref="https://redirect.github.com/github/codeql-action/pull/2744">#2744</a></li></ul><h2>3.28.7 - 29 Jan 2025</h2><p>No user facing changes.</p><h2>3.28.6 - 27 Jan 2025</h2><ul><li>Re-enable debug artifact upload for CLI versions 2.20.3 or greater.<ahref="https://redirect.github.com/github/codeql-action/pull/2726">#2726</a></li></ul><h2>3.28.5 - 24 Jan 2025</h2><ul><li>Update default CodeQL bundle version to 2.20.3. <ahref="https://redirect.github.com/github/codeql-action/pull/2717">#2717</a></li></ul><h2>3.28.4 - 23 Jan 2025</h2><p>No user facing changes.</p><h2>3.28.3 - 22 Jan 2025</h2><ul><li>Update default CodeQL bundle version to 2.20.2. <ahref="https://redirect.github.com/github/codeql-action/pull/2707">#2707</a></li><li>Fix an issue downloading the CodeQL Bundle from a GitHub EnterpriseServer instance which occurred when the CodeQL Bundle had been synced tothe instance using the <ahref="https://github.com/github/codeql-action-sync-tool">CodeQL Actionsync tool</a> and the Actions runner did not have Zstandard installed.<ahref="https://redirect.github.com/github/codeql-action/pull/2710">#2710</a></li><li>Uploading debug artifacts for CodeQL analysis is temporarilydisabled. <ahref="https://redirect.github.com/github/codeql-action/pull/2712">#2712</a></li></ul><h2>3.28.2 - 21 Jan 2025</h2><p>No user facing changes.</p><h2>3.28.1 - 10 Jan 2025</h2><ul><li>CodeQL Action v2 is now deprecated, and is no longer updated orsupported. For better performance, improved security, and new features,upgrade to v3. For more information, see <ahref="https://github.blog/changelog/2025-01-10-code-scanning-codeql-action-v2-is-now-deprecated/">thischangelog post</a>. <ahref="https://redirect.github.com/github/codeql-action/pull/2677">#2677</a></li></ul><!-- raw HTML omitted --></blockquote><p>... (truncated)</p></details><details><summary>Commits</summary><ul><li><ahref="https://github.com/github/codeql-action/commit/b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d"><code>b56ba49</code></a>Merge pull request <ahref="https://redirect.github.com/github/codeql-action/issues/2778">#2778</a>from github/update-v3.28.10-9856c48b1</li><li><ahref="https://github.com/github/codeql-action/commit/60c9c77c33f2cd66390a3778d54de88b735b2526"><code>60c9c77</code></a>Update changelog for v3.28.10</li><li><ahref="https://github.com/github/codeql-action/commit/9856c48b1a54789454314b4c32ef2354fe213208"><code>9856c48</code></a>Merge pull request <ahref="https://redirect.github.com/github/codeql-action/issues/2773">#2773</a>from github/redsun82/rust</li><li><ahref="https://github.com/github/codeql-action/commit/9572e09da430b4c71f7488e4195b4ca6ce1c6ef0"><code>9572e09</code></a>Rust: fix log string</li><li><ahref="https://github.com/github/codeql-action/commit/1a529366ac3620317d953e2d4018eafa7459cb1c"><code>1a52936</code></a>Rust: special case default setup</li><li><ahref="https://github.com/github/codeql-action/commit/cf7e90952bcceaebd4a548c2809ea6a5d461a1bc"><code>cf7e909</code></a>Merge pull request <ahref="https://redirect.github.com/github/codeql-action/issues/2772">#2772</a>from github/update-bundle/codeql-bundle-v2.20.5</li><li><ahref="https://github.com/github/codeql-action/commit/b7006aab6d38638d18e38a27c18f67138529c2f8"><code>b7006aa</code></a>Merge branch 'main' into update-bundle/codeql-bundle-v2.20.5</li><li><ahref="https://github.com/github/codeql-action/commit/cfedae723eaced5e13052b529375e7b00d49a9cd"><code>cfedae7</code></a>Rust: throw configuration errors if requested and not correctlyenabled</li><li><ahref="https://github.com/github/codeql-action/commit/3971ed2a74ede0669fa7f4f5af4292030280dbfd"><code>3971ed2</code></a>Merge branch 'main' into redsun82/rust</li><li><ahref="https://github.com/github/codeql-action/commit/d38c6e60dfb0232f85e388dd416559ed07da5f3a"><code>d38c6e6</code></a>Merge pull request <ahref="https://redirect.github.com/github/codeql-action/issues/2775">#2775</a>from github/angelapwen/bump-octokit</li><li>Additional commits viewable in <ahref="https://github.com/github/codeql-action/compare/9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0...b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d">compareview</a></li></ul></details><br />Dependabot will resolve any conflicts with this PR as long as you don'talter it yourself. You can also trigger a rebase manually by commenting`@dependabot rebase`.[//]: # (dependabot-automerge-start)[//]: # (dependabot-automerge-end)---<details><summary>Dependabot commands and options</summary><br />You can trigger Dependabot actions by commenting on this PR:- `@dependabot rebase` will rebase this PR- `@dependabot recreate` will recreate this PR, overwriting any editsthat have been made to it- `@dependabot merge` will merge this PR after your CI passes on it- `@dependabot squash and merge` will squash and merge this PR afteryour CI passes on it- `@dependabot cancel merge` will cancel a previously requested mergeand block automerging- `@dependabot reopen` will reopen this PR if it is closed- `@dependabot close` will close this PR and stop Dependabot recreatingit. You can achieve the same result by closing it manually- `@dependabot show <dependency name> ignore conditions` will show allof the ignore conditions of the specified dependency- `@dependabot ignore <dependency name> major version` will close thisgroup update PR and stop Dependabot creating any more for the specificdependency's major version (unless you unignore this specificdependency's major version or upgrade to it yourself)- `@dependabot ignore <dependency name> minor version` will close thisgroup update PR and stop Dependabot creating any more for the specificdependency's minor version (unless you unignore this specificdependency's minor version or upgrade to it yourself)- `@dependabot ignore <dependency name>` will close this group update PRand stop Dependabot creating any more for the specific dependency(unless you unignore this specific dependency or upgrade to it yourself)- `@dependabot unignore <dependency name>` will remove all of the ignoreconditions of the specified dependency- `@dependabot unignore <dependency name> <ignore condition>` willremove the ignore condition of the specified dependency and ignoreconditions</details>Signed-off-by: dependabot[bot] <support@github.com>Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>