Skip to content

Releases: ossf/scorecard-action

v2.4.0

26 Jul 16:53
@spencerschrock spencerschrock
v2.4.0
This tag was signed with the committer’s verified signature.
spencerschrock Spencer Schrock
SSH Key Fingerprint: iEdk6w6vKX4x8FmfzRZODCotdCVMA333R1fASrXv690 Learn about vigilant mode.
62b2cac
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.4.0 Latest
Marketplace
Latest
Marketplace

What's Changed

This update bumps the Scorecard version to the v5 release. For a complete list of changes, please refer to the v5.0.0 release notes. Of special note to Scorecard Action is the Maintainer Annotation feature, which can be used to suppress some Code Scanning false positives. Alerts will not be generated for any Scorecard Check with an annotation.

Documentation

New Contributors

Full Changelog: v2.3.3...v2.4.0

Contributors

jkowalleck and spencerschrock
Assets 2
Loading

v2.3.3

09 May 21:18
@spencerschrock spencerschrock
v2.3.3
This tag was signed with the committer’s verified signature.
spencerschrock Spencer Schrock
SSH Key Fingerprint: iEdk6w6vKX4x8FmfzRZODCotdCVMA333R1fASrXv690 Learn about vigilant mode.
dc50aa9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.3.3
Marketplace
Marketplace

Note

There is no v2.3.2 release as a step was skipped in the release process. This was fixed and re-released under the v2.3.3 tag

What's Changed

  • 🌱 Bump github.com/ossf/scorecard/v4 (v4.13.1) to github.com/ossf/scorecard/v5 (v5.0.0-rc1) by @spencerschrock in #1366
  • 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc1 to v5.0.0-rc2 by @spencerschrock in #1374
  • 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0-rc2.0.20240509182734-7ce860946928 by @spencerschrock in #1377

For a full changelist of what these include, see the v5.0.0-rc1 and v5.0.0-rc2 release notes.

Documentation

Full Changelog: v2.3.1...v2.3.3

Contributors

spencerschrock
Assets 2
Loading

v2.3.1

23 Oct 19:49
@spencerschrock spencerschrock
v2.3.1
This tag was signed with the committer’s verified signature.
spencerschrock Spencer Schrock
SSH Key Fingerprint: iEdk6w6vKX4x8FmfzRZODCotdCVMA333R1fASrXv690 Learn about vigilant mode.
0864cf1
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.3.1
Marketplace
Marketplace

What's Changed

  • 🌱 Bump github.com/ossf/scorecard/v4 from v4.13.0 to v4.13.1 by @spencerschrock in #1282
    • Adds additional Fuzzing detection and fixes a SAST bug related to detecting CodeQL. For a full changelist of what this includes, see the v4.13.1 release notes

Full Changelog: v2.3.0...v2.3.1

Contributors

spencerschrock
Assets 2
Loading

v2.3.0

06 Oct 21:10
@spencerschrock spencerschrock
v2.3.0
This tag was signed with the committer’s verified signature.
spencerschrock Spencer Schrock
SSH Key Fingerprint: iEdk6w6vKX4x8FmfzRZODCotdCVMA333R1fASrXv690 Learn about vigilant mode.
483ef80
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.3.0
Marketplace
Marketplace

What's Changed

  • 🌱 Bump github.com/ossf/scorecard/v4 from v4.11.0 to v4.13.0 by @spencerschrock in #1270
    • For a full changelist of what this includes, see the v4.12.0 and v4.13.0 release notes
  • ✨ Send rekor tlog index to webapp when publishing results by @spencerschrock in #1169
  • 🐛 Prevent url clipping for GHES instances by @rajbos in #1225

Documentation

New Contributors

Full Changelog: v2.2.0...v2.3.0

Contributors

david-a-wheeler, spencerschrock, and 2 other contributors
Assets 2
Loading

v2.2.0

23 Jun 21:19
@spencerschrock spencerschrock
v2.2.0
This tag was signed with the committer’s verified signature.
spencerschrock Spencer Schrock
SSH Key Fingerprint: iEdk6w6vKX4x8FmfzRZODCotdCVMA333R1fASrXv690 Learn about vigilant mode.
08b4669
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.2.0
Marketplace
Marketplace

What's Changed

Scorecard Result Viewer

Thanks to contributions from @cynthia-sg and @tegioz at CLOMonitor, there is a new Scorecard Result visualization page at https://securityscorecards.dev/viewer/?uri=<project-url>.

As an example, you can see our own score visualized here
Checkout our README to learn how to link your README badge to the new visualization page.

Publishing Results

This release contains two fixes which will improve the user experience when publish_results is true

  • Runs that fail our workflow restrictions will fail with a 400 response indicating the problem, instead of a vague 500 status. (#1156, resolved #1150)
  • Scorecard action will retry when signing results and submitting them to our web API. This should help with flakiness from connection failures. (#1191)

Docs

  • 📖 Update README to accept fine-grained tokens by @pnacht in #1175
  • 📖 Update installation instructions to match current GitHub UI by @joycebrum in #1153
  • 📖 Document the GitHub action workflow restrictions when publishing results. by @spencerschrock in

New Contributors

Full Changelog: v2.1.3...v2.2.0

Contributors

tegioz, cynthia-sg, and 4 other contributors
Assets 2
Loading

v2.1.3

29 Mar 20:29
@spencerschrock spencerschrock
v2.1.3
This tag was signed with the committer’s verified signature.
spencerschrock Spencer Schrock
SSH Key Fingerprint: iEdk6w6vKX4x8FmfzRZODCotdCVMA333R1fASrXv690 Learn about vigilant mode.
80e868c
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.1.3
Marketplace
Marketplace

What's Changed

Bug Fixes

  • Invalid SARIF files from a bug in scorecard
  • Vulnerabilities check crashes if a vulnerable dependency is found via OSVScanner
  • Scorecard action not reporting binary artifacts in the repo

Full Scorecard Changelog: ossf/scorecard@v4.10.2...v4.10.5

Full Changelog: v2.1.2...v2.1.3

Contributors

spencerschrock
Assets 2
Loading

v2.1.2

21 Dec 23:20
@spencerschrock spencerschrock
v2.1.2
This tag was signed with the committer’s verified signature.
spencerschrock Spencer Schrock
SSH Key Fingerprint: iEdk6w6vKX4x8FmfzRZODCotdCVMA333R1fASrXv690 Learn about vigilant mode.
e38b190
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.1.2
Marketplace
Marketplace

What's Changed

Fixes

  • 🌱 Bump scorecard dependency to v4.10.2 to remove a CODEOWNERS printf statement. by @spencerschrock in #1054

Full Changelog: v2.1.1...v2.1.2

Contributors

spencerschrock
Assets 2
Loading

v2.1.1

19 Dec 19:24
@laurentsimon laurentsimon
v2.1.1
15c10fc
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.1.1
Marketplace
Marketplace

Scorecard version

This release use Scorecard's v4.10.1

Full Changelog: v2.1.0...v2.1.1

Assets 2
Loading

v2.1.0

15 Dec 02:04
@laurentsimon laurentsimon
v2.1.0
937ffa9
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.1.0
Marketplace
Marketplace

What's Changed

Scorecard version

This release uses scorecard v4.10.0.

Improvements

Documentation

New Contributors

Full Changelog: v2.0.6...v2.1.0

Contributors

naveensrinivasan, spencerschrock, and 4 other contributors
Assets 2
Loading

v2.0.6

19 Oct 00:40
@naveensrinivasan naveensrinivasan
v2.0.6
This tag was signed with the committer’s verified signature.
naveensrinivasan Naveen
GPG key ID: F39F847B7B035ADE
Learn about vigilant mode.
99c5375
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.0.6
Marketplace
Marketplace

What's Changed

Full Changelog: v2.0.5...v2.0.6

Contributors

naveensrinivasan
Assets 2
Loading