From f050be8361bbfab6d9c22cfad59eb8bd89558a18 Mon Sep 17 00:00:00 2001 From: nqzai Date: Mon, 7 Sep 2026 19:18:06 +0530 Subject: [PATCH] ci: bump scorecard-action to v2.4.4 (gcr.io -> ghcr.io) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The weekly Scorecard run has been failing since 2026-09-07. The pinned v2.4.0 resolves to gcr.io/openssf/scorecard-action, and pulls now fail: denied: This API method requires billing to be enabled. That is OpenSSF's GCP project, not ours — Google retired gcr.io and OpenSSF republished the image on ghcr.io. v2.4.0 is the last release pointing at gcr.io; v2.4.1+ use ghcr.io/ossf/scorecard-action. Bumps to v2.4.4, SHA-pinned to the dereferenced tag commit. Co-Authored-By: Claude Opus 5 --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 1192820..7b63d45 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -26,7 +26,7 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif