[dependabot]

Bumps ossf/scorecard-action from 55891bbd73f2425e97637d96e306fc9d491d0b21 to 2d1146689b8cda280b9bc96326124645441f03bc.

Changelog

Sourced from ossf/scorecard-action's changelog.

Releasing the scorecard GitHub Action

This is a draft document to describe the release process for the scorecard GitHub Action.

(If there are improvements you'd like to see, please comment on the tracking issue or issue a pull request to discuss.)

• Tracking
• Preparing the release
  • Validate the Action
  • Update the scorecard-action version
• Drafting release notes
• Release
  • Create a tag
  • Create a GitHub release
• Update the starter workflow
• Announce

Tracking

As the first task, a Release Manager should open a tracking issue for the release.

We don't currently have a template for releasing, but the following issue is a good example to draw inspiration from.

We're not striving for perfection with the template, but the tracking issue will serve as a reference point to aggregate feedback, so try your best to be as descriptive as possible.

Preparing the release

This section covers changes that need to be issued as a pull request and should be merged before releasing the scorecard GitHub Action.

Validate the Action

The postsubmits.yml workflow runs on every push to main and weekly. It builds and pushes the ghcr.io/ossf/scorecard-action:latest image, then runs Scorecard on this repository with that image, uploading the SARIF and publishing the results.

Confirm that the postsubmits.yml run for the commit you plan to release succeeded, including the Scorecard analysis job (no error sending scorecard results line in its log). If there isn't one, run the workflow manually.

... (truncated)

Commits

• See full diff in compare view

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.

[anurag-stepsecurity]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[anurag-stepsecurity]

@dependabot recreate