fix(ci): bump scorecard-action to v2.4.4 so the image pulls again - #940
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
The Scorecard workflow has failed on every recent main run — six consecutive at the time of writing. The cause is upstream, not this repo: v2.4.0's action image lives at `gcr.io/openssf/scorecard-action`, and pulls now return denied: This API method requires billing to be enabled. Please enable billing on project #367732848534 A workflow that is red on every commit trains everyone to stop reading red, so this is worth fixing rather than muting. v2.4.1 moved the image to `ghcr.io/ossf/scorecard-action`; verified that the v2.4.4 manifest is anonymously pullable from ghcr.io (HTTP 200). The three inputs this workflow passes — results_file, results_format, publish_results — are unchanged in v2.4.4, and no release between v2.4.0 and v2.4.4 notes a breaking change affecting this usage. SHA 2d1146689b8cda280b9bc96326124645441f03bc is the commit tag v2.4.4 points at. This is the only place in the repo that pins scorecard-action. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
blove
force-pushed
the
blove/ci-scorecard-ghcr
branch
from
September 1, 2026 22:38
2b77d74 to
21dd07e
Compare
blove
enabled auto-merge (squash)
September 1, 2026 22:38
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
.github/workflows/scorecard.ymlhas failed on every recent push tomain— six consecutive runs. The cause is upstream, not this repo.v2.4.0's action image lives at
gcr.io/openssf/scorecard-action, and pulls now fail:That is OpenSSF's own GCP project. Nothing here can fix it, and a workflow that is red on every commit trains everyone to stop reading red — so this is worth fixing rather than muting.
Fix
v2.4.1 moved the image to GitHub Container Registry. Diffing
action.yamlacross tags:docker://gcr.io/openssf/scorecard-action:v2.4.0docker://ghcr.io/ossf/scorecard-action:<tag>Bumping to v2.4.4 (current release) therefore sidesteps the dead registry entirely, without changing the job's shape, its container-vs-composite form, or making it non-blocking.
Verification
HTTP 200.results_file,results_format,publish_results) all still exist in v2.4.4'saction.yaml.2d1146689b8cda280b9bc96326124645441f03bcis the commit that tagv2.4.4dereferences to (the tag is annotated;git/ref/tags/v2.4.4returns the tag object, not the commit).Pin safety
Grepped the old SHA
62b2cac7ed8198b15735ed49ab1e5cf35480ba46across the repo: this workflow is the only occurrence. This repo has no independent action-pin validator (noscripts/release/preflight.mjs), so there is no second site to keep in sync.🤖 Generated with Claude Code