Update ossf/scorecard-action action to v2.5.0 (main)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
ossf/scorecard-action	action	minor	v2.4.4 → v2.5.0

---

Release Notes

ossf/scorecard-action

v2.5.0

Compare Source

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.

• The action's container image is built with Go 1.27.2 on a refreshed distroless base. by
  @​justaugustus in #​1716
• The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still
  recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in #​1716
• The Scorecard version in results now always matches the Scorecard release the action is built
  with. by @​justaugustus in #​1718
• The action no longer prints the GitHub token variable while validating its options. by
  @​arpitjain099 in #​1709
• results_format accepts intoto, which wraps the JSON results in an in-toto attestation
  statement. by @​puerco in #​1702

Other

• Add a daily canary against Scorecard main by @​justaugustus in #​1711
• Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by @​justaugustus in #​1714
• Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update
  RELEASE.md by @​justaugustus in #​1716
• Bump Scorecard to v5.6.0 by @​justaugustus in #​1719

New Contributors

• @​arpitjain099 made their first contribution in #​1709
• @​puerco made their first contribution in #​1702

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: a98f5fcd-5803-49a1-b82b-d0c4a5eb42b1

📥 Commits

Reviewing files that changed from the base of the PR and between 030b8f7 and 313f4ce.

📒 Files selected for processing: 1

• .github/workflows/scorecards.yml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 5 remain after this review.

📝 Walkthrough

The Scorecard workflow now pins ossf/scorecard-action to the v2.5.0 commit instead of the v2.4.4 commit. The remaining workflow configuration is unchanged.

Changes: Scorecard workflow update

Layer / File(s)	Summary
Update the Scorecard action pin .github/workflows/scorecards.yml	The workflow pins ossf/scorecard-action to commit fa7117db83c52d787ae5a89f350999701505d78e instead of 2d1146689b8cda280b9bc96326124645441f03bc.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: acepresso, bohdanmar

Merge Risk: ⚪ Minimal · up to 313f4

The action update is compatible with the existing Scorecard workflow and presents no identified merge-blocking risk.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the update from ossf/scorecard-action to v2.5.0, which matches the main change.
Description check		The description directly documents the ossf/scorecard-action v2.4.4 to v2.5.0 update and its release details.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}