From 4620c76b38f478f21a88b354ce6794dcfacba755 Mon Sep 17 00:00:00 2001 From: Spencer Schrock Date: Wed, 27 Mar 2024 13:25:03 -0700 Subject: [PATCH] update Scorecard Action hashes and version comments (#2348) * update action hashes and version comments ossf/scorecard-action v2.1.2 is old and doesnt work after a Sigstore change. https://blog.sigstore.dev/tuf-root-update/ Signed-off-by: Spencer Schrock * downgrade actions/upload-artifact to node20 version of v3 dependabot will suggest upgrade to v4.3.1 for repos that can upgrade. note: v3.pre.node20 is how dependabot refers to the pinned hash, so use that so it can upgrade the comment Signed-off-by: Spencer Schrock * upgrade github/codeql-action/upload-sarif to v3.24.9 Signed-off-by: Spencer Schrock --------- Signed-off-by: Spencer Schrock Co-authored-by: Alexis Abril --- code-scanning/scorecard.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/code-scanning/scorecard.yml b/code-scanning/scorecard.yml index 19b9b00..162c788 100644 --- a/code-scanning/scorecard.yml +++ b/code-scanning/scorecard.yml @@ -32,19 +32,19 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 with: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # v2.1.2 + uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1 with: results_file: results.sarif results_format: sarif # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: # - you want to enable the Branch-Protection check on a *public* repository, or # - you are installing Scorecard on a *private* repository - # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. + # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional. # repo_token: ${{ secrets.SCORECARD_TOKEN }} # Public repositories: @@ -59,14 +59,15 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0 + uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20 with: name: SARIF file path: results.sarif retention-days: 5 - # Upload the results to GitHub's code scanning dashboard. + # Upload the results to GitHub's code scanning dashboard (optional). + # Commenting out will disable upload of results to your repo's Code Scanning dashboard - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4 + uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9 with: sarif_file: results.sarif