Skip to content

build(deps): bump ossf/scorecard-action from 2.0.3 to 2.4.4 - #7

Open
dependabot[bot] wants to merge 9 commits into
hubv3-6.6.yfrom
dependabot/github_actions/ossf/scorecard-action-2.4.3
Open

build(deps): bump ossf/scorecard-action from 2.0.3 to 2.4.4#7
dependabot[bot] wants to merge 9 commits into
hubv3-6.6.yfrom
dependabot/github_actions/ossf/scorecard-action-2.4.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 6, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps ossf/scorecard-action from 2.0.3 to 2.4.4.

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.4

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

v2.4.3

What's Changed

This update bumps the Scorecard version to the v5.3.0 release. For a complete list of changes, please refer to the Scorecard v5.3.0 release notes.

Documentation

Other

New Contributors

Full Changelog: ossf/scorecard-action@v2.4.2...v2.4.3

v2.4.2

What's Changed

This update bumps the Scorecard version to the v5.2.1 release. For a complete list of changes, please refer to the Scorecard v5.2.0 and v5.2.1 release notes.

Full Changelog: ossf/scorecard-action@v2.4.1...v2.4.2

v2.4.1

What's Changed

  • This update bumps the Scorecard version to the v5.1.1 release. For a complete list of changes, please refer to the v5.1.0 and v5.1.1 release notes.
  • Publishing results now uses half the API quota as before. The exact savings depends on the repository in question.
  • Some errors were made into annotations to make them more visible
  • There is now an optional file_mode input which controls how repository files are fetched from GitHub. The default is archive, but git produces the most accurate results for repositories with .gitattributes files at the cost of analysis speed.
  • The underlying container for the action is now hosted on GitHub Container Registry. There should be no functional changes.

Docs

... (truncated)

Changelog

Sourced from ossf/scorecard-action's changelog.

Releasing the scorecard GitHub Action

This is a draft document to describe the release process for the scorecard GitHub Action.

(If there are improvements you'd like to see, please comment on the tracking issue or issue a pull request to discuss.)

Tracking

As the first task, a Release Manager should open a tracking issue for the release.

We don't currently have a template for releasing, but the following issue is a good example to draw inspiration from.

We're not striving for perfection with the template, but the tracking issue will serve as a reference point to aggregate feedback, so try your best to be as descriptive as possible.

Preparing the release

This section covers changes that need to be issued as a pull request and should be merged before releasing the scorecard GitHub Action.

Validate the Action

The postsubmits.yml workflow runs on every push to main and weekly. It builds and pushes the ghcr.io/ossf/scorecard-action:latest image, then runs Scorecard on this repository with that image, uploading the SARIF and publishing the results.

Confirm that the postsubmits.yml run for the commit you plan to release succeeded, including the Scorecard analysis job (no error sending scorecard results line in its log). If there isn't one, run the workflow manually.

... (truncated)

Commits
  • 2d11466 Bump action tag for v2.4.4 release (#1688)
  • 1bd3285 🌱 Bump the docker-images group across 1 directory with 2 updates (#1...
  • 913edce 🌱 Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (#1671)
  • 0957b8f 🌱 Bump golang.org/x/net from 0.56.0 to 0.57.0 (#1680)
  • f0061eb 🌱 Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#1687)
  • 20ee732 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 (#1685)
  • 9f295ef 🌱 Bump the github-actions group with 6 updates (#1686)
  • 69bf556 🌱 Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 (#1681)
  • 94e8b96 🌱 Bump github.com/sigstore/rekor from 1.5.0 to 1.5.2 (#1673)
  • c7a1b37 🌱 Bump github.com/sigstore/fulcio from 1.8.5 to 1.8.6 (#1675)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 6, 2025
@dependabot dependabot Bot mentioned this pull request Oct 6, 2025
Closed
liuguoping1024 and others added 9 commits September 30, 2026 18:38
@liuguoping1024
feat(wifi): Update the W155S1 WiFi driver to v1.8.3.3
645202c 
Replace the vendored Amlogic W1 driver in jethome-0004, v1.6.3_20240426
-> v1.8.3.3_20260310 (driver:888ce88b817c15e731df70f+612585+643887+589776).
The BT sdio driver is unchanged; the aml_sdio exports it links against and
the shared w1_sdio.h structures are identical.

Local changes carried over from the 1.6.3 tree:
  - in-tree kbuild include paths ($(src)) in vmac/Makefile
  - WIFIMAC_PATH and WIFI_CONF_PATH under /usr/lib/firmware/w1
  - rssi/reg dump paths under /lib/firmware/w1
  - pairwise key dump in vm_cfg80211_add_key() commented out; it sits in
    the default AML_DEBUG_CFG80211 mask and would log the key
  - sha256_* renamed to sha256_*_i, crc32() prototype dropped (clash with
    kernel exports)
  - static print_version.c (create_version_file.pl is not run in-tree)

New for 1.8.3.3:
  - include <linux/upstream_version.h> only if present (vendor kernels only)
  - drop the opt_all.h block that remapped every pr_debug() to pr_info();
    its #ifndef was malformed and it made ~1000 debug prints unconditional

Drop jethome-0010: 1.8.3.3 fixes the RSN-parse failure path itself. 1.6.3
did memcmp(se, oldse) with oldse == NULL on new entries, which is the
wifi_mac_scan_rx+0x59c Oops seen in the field right after
"RSN mcast/akm cipher wrong"; the vendor now frees new entries directly
and unlinks listed ones under the caller's st_lock before freeing.

RF txt files are installed from packages/bsp and are not touched.

Build-tested on v6.6.129 (Image, modules, dtbs; all module symbols
resolve). Not yet boot tested on hardware.
@liuguoping1024
feat(uboot): Use ThirdReality FIP for trhubv3
92b55b6 
Sign trhubv3 u-boot with thirdreality/amlogic-boot-fip branch hubv3
(Amlogic SDK 2025r1 bl2/bl30/bl31, HubV3 DDR4 acs.bin). Other trhub
boards still use jethub-j100.
@liuguoping1024
feat(burn): Use own SDK 2025r1 USB loaders for hubv3
f567455 
Replace bins/hubv3 DDR.USB/UBOOT.USB with u-boot.bin.usb.bl2/.usb.tpl
built from Amlogic SDK 2025r1 board axg_hubv3_v1 (HubV3 DDR4 acs,
bl30 v1.1.3545, bl31 v1.3.2), drop the JetHome .default copies, rename
amlogic-dt-id to axg_hubv3_v1 and point convert.sh v3 at bins/hubv3.
v3a/v3b still use bins/j100.
@liuguoping1024
feat(board): Add ThirdReality HubV3L (trhubv3l)
94dcacd 
HubV3L (LinuxBox-Lite MB0.5) has the HubV3 pinout and software; only RAM
differs (2x DDR3, 2 ranks, 1GB).

- config/boards/trhubv3l.conf, BOOTCONFIG trhub_v3l_defconfig,
  BOOT_FDT_FILE meson-axg-thirdreality-trhub-v3l.dtb
- u-boot board_trhubv3l: board_trhubv3 patches + v3l DTS/defconfig
- kernel dt/meson-axg-thirdreality-trhub-v3l.dts: v3 with /memory = 1GB
- FIP thirdreality-hubv3l (DDR3 2-rank acs.bin)
- burn: bins/hubv3l from SDK 2025r1 axg_hubv3l_v1, dt-id axg_hubv3l_v1,
  convert.sh v3l
- release info, factory-reset, supervisor prefix and BSP same as trhubv3
- make-armbian-build-release.sh -b hubv3l
@liuguoping1024
fix(firstrun): Enable W155S1 WiFi/BT services on TRHub-V3L
b1448f4 
armbian-firstrun only enabled amlogicw1 and amlogicw1-bt for V3, V3B
and V3A, so V3L booted with both services disabled and no wlan0.
@liuguoping1024
feat(burn): Move v3a/v3b off JetHub FIP and loaders, drop JetHub burn…
0b4f281 
… files

- v3b = v3 hardware: FIP thirdreality-hubv3, bins/hubv3, dt-id axg_hubv3_v1
- v3a = v3l RAM (2x DDR3, 2 ranks, 1GB): FIP thirdreality-hubv3l,
  bins/hubv3l, dt-id axg_hubv3l_v1. Its u-boot DTS hardcoded 2GB via
  trhub_v3_defconfig; add trhub_v3a_defconfig + 1GB v3a DTS (0013) and
  make board_trhubv3a a copy of board_trhubv3l instead of a symlink to v3
- fix 1GB /memory in the v3a and v3l burn DTS
- remove bins/j100 j80 j200 magicbox, JetHub DTS, non-axg dtsi/headers,
  convert.sh d1/d2/h1/cma and the jethubj* release cases; rewrite README
- linuxbox board keeps jethub-j100 FIP (no SDK board for it)
@liuguoping1024
chore(burn): Fail convert.sh on errors, document loaders, credit JetHome
cea14a0 
- convert.sh: usage/unknown variant/partition/missing input now exit 1
- remove unused bins/hubv3*/image.*.cfg (convert uses bins/image.*.cfg)
- README: partition layout, how to regenerate DDR.USB/UBOOT.USB from the
  SDK, origin
- CREDITS.md: JetHome / Vyacheslav Bocharov and jethome-tools
@liuguoping1024
feat(burn): Use amlogic-boot-tools for FIP and burn image, drop amlog…
5fce653 
…ic-tools.repo

FIP blobs and the USB burn converter now live in one repo,
thirdreality/amlogic-boot-tools (branch hubv3), fetched to
cache/sources/amlogic-boot-tools:

  fip/hubv3, fip/hubv3l  used by uboot_custom_postprocess
  burn/convert.sh        run by make-armbian-build-release.sh in .tmp/burn

convert.sh failures now abort the release build.

Verified on HubV3: USB burn with the SDK 2025r1 loaders, first boot,
WiFi and BT up.
@dependabot
build(deps): bump ossf/scorecard-action from 2.0.3 to 2.4.4
9811984 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.0.3 to 2.4.4.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@865b409...2d11466)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot changed the base branch from hubv3 to hubv3-6.6.y October 12, 2026 06:58
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/ossf/scorecard-action-2.4.3 branch from 251bcf1 to 9811984 Compare October 12, 2026 06:58
@dependabot dependabot Bot changed the title Bump ossf/scorecard-action from 2.0.3 to 2.4.3 build(deps): bump ossf/scorecard-action from 2.0.3 to 2.4.4 Oct 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code Software ⛓️

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@liuguoping1024