From ac2a93218128a26119a9fa5bcb8c9b6b141e35b7 Mon Sep 17 00:00:00 2001 From: Lakhan Samani Date: Thu, 3 Sep 2026 17:23:14 +0530 Subject: [PATCH] ci: bump scorecard-action to v2.4.4 (GCR -> GHCR) Scorecard has failed on every push since 2026-08-31. Not a regression in this repo: v2.3.1 runs `docker://gcr.io/openssf/scorecard-action:v2.3.1`, and GCR now refuses the pull with denied: This API method requires billing to be enabled ... project #367732848534 Google is sunsetting Container Registry, so the image is unreachable regardless of anything here. v2.4.4 runs `docker://ghcr.io/ossf/scorecard-action:v2.4.4` instead. Still pinned by commit SHA with a version comment, which is what Scorecard's own Pinned-Dependencies check wants. Claude-Session: https://claude.ai/code/session_016dbRdiyrapnT7J3tAyZhdR --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index d42cbc11c..08fddebc7 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -45,7 +45,7 @@ jobs: persist-credentials: false - name: Run Scorecard analysis - uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1 + uses: ossf/scorecard-action@55891bbd73f2425e97637d96e306fc9d491d0b21 # v2.4.4 with: results_file: results.sarif results_format: sarif