ci(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0

[dependabot]

Bumps ossf/scorecard-action from 2.4.4 to 2.5.0.

Release notes

Sourced from ossf/scorecard-action's releases.

v2.5.0

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the Scorecard v5.6.0 release notes.

• The action's container image is built with Go 1.27.2 on a refreshed distroless base. by @​justaugustus in ossf/scorecard-action#1716
• The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in ossf/scorecard-action#1716
• The Scorecard version in results now always matches the Scorecard release the action is built with. by @​justaugustus in ossf/scorecard-action#1718
• The action no longer prints the GitHub token variable while validating its options. by @​arpitjain099 in ossf/scorecard-action#1709
• results_format accepts intoto, which wraps the JSON results in an in-toto attestation statement. by @​puerco in ossf/scorecard-action#1702

Other

• Add a daily canary against Scorecard main by @​justaugustus in ossf/scorecard-action#1711
• Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by @​justaugustus in ossf/scorecard-action#1714
• Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update RELEASE.md by @​justaugustus in ossf/scorecard-action#1716
• Bump Scorecard to v5.6.0 by @​justaugustus in ossf/scorecard-action#1719

New Contributors

• @​arpitjain099 made their first contribution in ossf/scorecard-action#1709
• @​puerco made their first contribution in ossf/scorecard-action#1702

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

Commits

• fa7117d Bump action tag for v2.5.0 release (#1720)
• cef4eb5 🌱 Bump Scorecard to v5.6.0 (#1719)
• bedb16e ✨ Add intoto results format (#1702)
• de70347 Remove the leftover debug print of the auth token (#1709)
• 950873d 🌱 Derive the reported Scorecard version from go.mod (#1718)
• 2ce8ee4 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (#1695)
• aabdf5a 🌱 Bump the github-actions group across 1 directory with 7 updates (#...
• b4b9adf 🌱 CodeQL: Analyze workflows instead of a placeholder JavaScript file
• 4e9f2a2 📖 RELEASE.md: Document drafting release notes
• f618e8b 🌱 Build the image with Go 1.27.2 and refresh distroless
• Additional commits viewable in compare view

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/ossf/scorecard-action	fa7117db83c52d787ae5a89f350999701505d78e	🟢 7.9	Details Check Score Reason Code-Review ⚠️ 1 Found 2/14 approved changesets -- score normalized to 1 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Dependency-Update-Tool 🟢 10 update tool detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Pinned-Dependencies 🟢 9 dependency not pinned by hash detected -- score normalized to 9 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Signed-Releases ⚠️ -1 no releases found License 🟢 10 license file detected Vulnerabilities 🟢 7 3 existing vulnerabilities detected Packaging 🟢 10 packaging workflow detected Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 20 out of 20 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 16 contributing companies or organizations

Scanned Files

• .github/workflows/scorecards.yml