From 74bc3e04705cce6883929abff8bf3d1b497e7a5e Mon Sep 17 00:00:00 2001 From: Akshay-Narayan-pai Date: Wed, 23 Sep 2026 12:22:44 +0530 Subject: [PATCH] chore(actions): bump scorecard-action to v2.4.4 and codeql-action to v4.37.9 Bumps the two security-scanning actions and keeps every codeql-action subpath on one version. - ossf/scorecard-action v2.4.0 -> v2.4.4 - github/codeql-action init, analyze, upload-sarif v3.37.9 -> v4.37.9 The codeql-action subpaths must move together: init and analyze negotiate over a shared state directory, so a split version pair fails at the analyze step. Dependabot proposes each subpath separately (#6 bumps only analyze), which is why they are bundled here instead. codeql-action v4 differs from v3 only in running on Node.js 24. Both workflows use ubuntu-latest, which provides it. The v3 and v4 lines ship in parallel at matching patch levels. scorecard-action v2.4.4 publishes results to api.scorecard.dev rather than api.securityscorecards.dev. Updates the workflow comment and the README badge host to match; the old host still redirects, so the badge change is for accuracy rather than repair. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_014Z8F6zDFV8KeU3G8JrCGko --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 6 +++--- README.md | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f3546be..548b150 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -51,7 +51,7 @@ jobs: cache: true - name: Initialise CodeQL - uses: github/codeql-action/init@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: go queries: security-and-quality @@ -62,6 +62,6 @@ jobs: run: go build ./... - name: Analyse - uses: github/codeql-action/analyze@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: "/language:go" diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 9a0fb0a..c40b91c 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -50,11 +50,11 @@ jobs: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif - # publish_results=true sends the score to api.securityscorecards.dev + # publish_results=true sends the score to api.scorecard.dev # which powers the README badge and the public scorecard.dev site. # Disable if you ever fork this workflow into a private mirror. publish_results: true @@ -67,6 +67,6 @@ jobs: retention-days: 5 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9 + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: sarif_file: results.sarif diff --git a/README.md b/README.md index 0fb4db5..27f76c1 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ [![Test](https://github.com/amagioss/OpenTAMS/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/amagioss/OpenTAMS/actions/workflows/test.yml) [![Lint](https://github.com/amagioss/OpenTAMS/actions/workflows/lint.yml/badge.svg?branch=main)](https://github.com/amagioss/OpenTAMS/actions/workflows/lint.yml) [![Build](https://github.com/amagioss/OpenTAMS/actions/workflows/build.yml/badge.svg?branch=main)](https://github.com/amagioss/OpenTAMS/actions/workflows/build.yml) -[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/amagioss/opentams/badge)](https://scorecard.dev/viewer/?uri=github.com/amagioss/opentams) +[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/amagioss/opentams/badge)](https://scorecard.dev/viewer/?uri=github.com/amagioss/opentams) [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE) [![Go Version](https://img.shields.io/badge/go-1.26-00ADD8?logo=go)](go.mod) [![TAMS Spec](https://img.shields.io/badge/TAMS-v8.0-5C2D91)](https://bbc.github.io/tams/main/index.html)