From 848b2d273ffa3e88f01ed5e5708e5709bf038142 Mon Sep 17 00:00:00 2001 From: Gold Okpa Date: Wed, 9 Sep 2026 21:13:27 +0100 Subject: [PATCH] fix(ci): restore Scorecard scanning with GHCR-backed action Update Scorecard to v2.4.4 and SARIF upload to CodeQL v4, pin action revisions, and explicitly grant checkout read access. Keep scanning, result publication and branch protections enabled. --- .github/workflows/scorecard.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 1586e73e..6e391783 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -14,6 +14,7 @@ jobs: name: Scorecard analysis runs-on: ubuntu-latest permissions: + contents: read # Needed to upload the results to code-scanning dashboard. security-events: write # Used to receive a badge. (Upcoming feature) @@ -21,19 +22,20 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false - name: "Run Scorecard" - uses: ossf/scorecard-action@v2.3.0 + # v2.4.4 uses GHCR; the old v2.3.0 GCR image fails before scanning. + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif publish_results: true - name: "Upload SARIF results to code scanning" - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 with: sarif_file: results.sarif wait-for-processing: true