This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ossf/scorecard-action](https://redirect.github.com/ossf/scorecard-action) | action | minor | `v2.4.4` → `v2.5.0` | --- ### Release Notes <details> <summary>ossf/scorecard-action (ossf/scorecard-action)</summary> ### [`v2.5.0`](https://redirect.github.com/ossf/scorecard-action/releases/tag/v2.5.0) [Compare Source](https://redirect.github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0) #### What's Changed This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure. For changes to checks and results, and what the infrastructure move means for you, see the [Scorecard v5.6.0 release notes](https://redirect.github.com/ossf/scorecard/releases/tag/v5.6.0). - The action's container image is built with Go 1.27.2 on a refreshed distroless base. by [@justaugustus](https://redirect.github.com/justaugustus) in [#1716](https://redirect.github.com/ossf/scorecard-action/pull/1716) - The installer (`cmd/installer`) now creates `.github/workflows/scorecard.yml`, and still recognizes existing `scorecards.yml` and `scorecards-analysis.yml` workflows. by [@justaugustus](https://redirect.github.com/justaugustus) in [#1716](https://redirect.github.com/ossf/scorecard-action/pull/1716) - The Scorecard version in results now always matches the Scorecard release the action is built with. by [@justaugustus](https://redirect.github.com/justaugustus) in [#1718](https://redirect.github.com/ossf/scorecard-action/pull/1718) - The action no longer prints the GitHub token variable while validating its options. by [@arpitjain099](https://redirect.github.com/arpitjain099) in [#1709](https://redirect.github.com/ossf/scorecard-action/pull/1709) - `results_format` accepts `intoto`, which wraps the JSON results in an in-toto attestation statement. by [@puerco](https://redirect.github.com/puerco) in [#1702](https://redirect.github.com/ossf/scorecard-action/pull/1702) ##### Other - Add a daily canary against Scorecard main by [@justaugustus](https://redirect.github.com/justaugustus) in [#1711](https://redirect.github.com/ossf/scorecard-action/pull/1711) - Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by [@justaugustus](https://redirect.github.com/justaugustus) in [#1714](https://redirect.github.com/ossf/scorecard-action/pull/1714) - Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update RELEASE.md by [@justaugustus](https://redirect.github.com/justaugustus) in [#1716](https://redirect.github.com/ossf/scorecard-action/pull/1716) - Bump Scorecard to v5.6.0 by [@justaugustus](https://redirect.github.com/justaugustus) in [#1719](https://redirect.github.com/ossf/scorecard-action/pull/1719) #### New Contributors - [@arpitjain099](https://redirect.github.com/arpitjain099) made their first contribution in [#1709](https://redirect.github.com/ossf/scorecard-action/pull/1709) - [@puerco](https://redirect.github.com/puerco) made their first contribution in [#1702](https://redirect.github.com/ossf/scorecard-action/pull/1702) **Full Changelog**: <ossf/scorecard-action@v2.4.4...v2.5.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/prometheus/client_java).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
-Original file line number
+Diff line change
           persist-credentials: false
       - name: Run OSSF Scorecard analysis
 -        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
 +        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
         with:
           results_file: results.sarif
           results_format: sarif