chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 - #920
chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4#920dependabot[bot] wants to merge 9 commits into
Conversation
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.3 to 2.4.4. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...2d11466) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
@opencode-agent review Evaluate exact current head |
|
Exact-head source review note for |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Independent exact-head review for Dependabot-authored bec3796d620ca87a25c67857ee4847b2cd506618 against protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
Reviewed the complete three-file diff. Each location replaces the existing full-SHA OpenSSF Scorecard v2.4.3 pin with the upstream v2.4.4 full commit 2d1146689b8cda280b9bc96326124645441f03bc; workflow triggers, permissions, checkout isolation, arguments, SARIF filtering, artifact retention, publication policy, and security boundaries are otherwise unchanged. The updated Scorecard workflow itself and all seven other directly triggered exact-head security/supply-chain workflows are terminal-success.
Approved as a non-author source review. This approval does not reinterpret absent required contexts as success and does not bypass any last-push, automated-review, or protected-branch requirement.
|
Exact-current-head automated review request for A qualifying non-author human approval is already anchored to this Dependabot-authored head. Independently review the three full-SHA OpenSSF Scorecard v2.4.4 pin replacements and confirm no trigger, permission, argument, SARIF, publication, or fail-closed boundary changed. All eight exact-head hosted workflows are terminal-success and no thread exists. Keep the exact head unchanged. Do not synthesize author approval, update the branch, merge, release, or bypass protection. @opencode-agent review |
Rate Limit Exceeded
|
CWE-829: scorecard-pr and scorecard-analysis must share one immutable SHA so a Dependabot split cannot execute a second unreviewed control sphere.
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
Pull request was converted to draft
|
Returned to Draft because this is no longer a clean Dependabot action-pin update. The intended slice is a single-version Recreate or rebuild from protected |
|
@coderabbitai review Review only exact current head |
Rate Limit Exceeded
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
c94deed510f98164c67245b72f9a8806265fb0d5. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31805147498/job/94782168788)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31805147498/job/94782168788)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (3 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (3 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (3 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: scorecard-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: scorecard-action-single-version.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path. Findings1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
gh pr checkout 920 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:dependabot/github_actions/main/ossf/scorecard-action-2.4.4
# rebase path only: git push --force-with-lease origin HEAD:dependabot/github_actions/main/ossf/scorecard-action-2.4.4
Merge Conflict Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: scorecard-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_scorecard_action_pin_contract.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: scorecard-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_scorecard_action_pin_contract.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
Merge Conflict Guidance
gh pr checkout 920 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:dependabot/github_actions/main/ossf/scorecard-action-2.4.4
# rebase path only: git push --force-with-lease origin HEAD:dependabot/github_actions/main/ossf/scorecard-action-2.4.4 |
|
@opencode-agent review Review exact unchanged Ready head |
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.
Findings
1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
- Problem: GitHub reports mergeStateStatus
DIRTYfor this pull request. - Root cause: Branch
dependabot/github_actions/main/ossf/scorecard-action-2.4.4cannot be merged cleanly intomain; the changed-file flow below shows which review/runtime path is blocked by the conflict. - Fix: Merge or rebase the latest
mainintodependabot/github_actions/main/ossf/scorecard-action-2.4.4, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch. - Repair commands:
gh pr checkout 920 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:dependabot/github_actions/main/ossf/scorecard-action-2.4.4
# rebase path only: git push --force-with-lease origin HEAD:dependabot/github_actions/main/ossf/scorecard-action-2.4.4- Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.
Merge Conflict Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: scorecard-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_scorecard_action_pin_contract.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
- Result: REQUEST_CHANGES
- Reason: mergeStateStatus is
DIRTY; mergeable isCONFLICTING. - Head SHA:
0b341f11254d1e3f7ad212114c54be03ef03d0ae - Workflow run: 31939594765
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: scorecard-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_scorecard_action_pin_contract.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
Keep the Scorecard v2.4.4 pin and the current-main lock/conflict-scope changelog lines so the Dependabot bump stays unique-source after merge.
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.
Findings
1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
- Problem: GitHub reports mergeStateStatus
DIRTYfor this pull request. - Root cause: Branch
dependabot/github_actions/main/ossf/scorecard-action-2.4.4cannot be merged cleanly intomain; the changed-file flow below shows which review/runtime path is blocked by the conflict. - Fix: Merge or rebase the latest
mainintodependabot/github_actions/main/ossf/scorecard-action-2.4.4, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch. - Repair commands:
gh pr checkout 920 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:dependabot/github_actions/main/ossf/scorecard-action-2.4.4
# rebase path only: git push --force-with-lease origin HEAD:dependabot/github_actions/main/ossf/scorecard-action-2.4.4- Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.
Merge Conflict Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: scorecard-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_scorecard_action_pin_contract.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
- Result: REQUEST_CHANGES
- Reason: mergeStateStatus is
DIRTY; mergeable isCONFLICTING. - Head SHA:
3ed996caed8a69eaf40021343859bba0729e9da5 - Workflow run: 32235114736
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: scorecard-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_scorecard_action_pin_contract.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.
Findings
1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
- Problem: GitHub reports mergeStateStatus
DIRTYfor this pull request. - Root cause: Branch
dependabot/github_actions/main/ossf/scorecard-action-2.4.4cannot be merged cleanly intomain; the changed-file flow below shows which review/runtime path is blocked by the conflict. - Fix: Merge or rebase the latest
mainintodependabot/github_actions/main/ossf/scorecard-action-2.4.4, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch. - Repair commands:
gh pr checkout 920 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:dependabot/github_actions/main/ossf/scorecard-action-2.4.4
# rebase path only: git push --force-with-lease origin HEAD:dependabot/github_actions/main/ossf/scorecard-action-2.4.4- Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.
Merge Conflict Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: scorecard-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_scorecard_action_pin_contract.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
- Result: REQUEST_CHANGES
- Reason: mergeStateStatus is
DIRTY; mergeable isCONFLICTING. - Head SHA:
3ed996caed8a69eaf40021343859bba0729e9da5 - Workflow run: 32256835335
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: scorecard-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_scorecard_action_pin_contract.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
Dismissed because the reviewed commit is no longer the current PR head; please review the exact current head.
|
Resolved the current-main merge conflict with a normal merge commit. Scorecard action pin contract still passes for the single immutable v2.4.4 SHA. Exact head |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
|
The exact-head Strix failure is infrastructure-only: the trusted Strix run reached the scan, reported zero vulnerabilities before execution, then Caido guest bootstrap failed after 10 attempts because 127.0.0.1:48080 refused connections. No source finding or test failure was reported, so the Strix gate was not weakened. I am rerunning the failed hosted job for the same exact head. |
|
The exact-head Strix run reported zero vulnerabilities before Caido guest bootstrap failed after 10 attempts because 127.0.0.1:48080 refused connections. This is runner infrastructure failure, not a source finding; the security gate remains fail-closed. Rerunning the failed hosted job. |
opencode-agent
Bot
added
area: dependencies
|
Superseded by clean protected-main replacement #1275, which preserves the official v2.4.4 update across all central Scorecard uses while removing stale branch pollution and duplicate release notes. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Outcome
Align every organization-owned OpenSSF Scorecard Action use to the official full commit SHA for v2.4.4:
ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bcThe same immutable action now drives pull-request visibility, scheduled default-branch posture analysis, and the Scorecard slice of the central security scan without changing permissions, SARIF semantics, or policy thresholds.
Bounded scope
Exact current head:
0b341f11254d1e3f7ad212114c54be03ef03d0ae.The protected-base diff is limited to:
.github/workflows/scorecard-analysis.yml.github/workflows/scorecard-pr.yml.github/workflows/security-scan.ymltests/test_scorecard_action_pin_contract.pydocs/doctoring/scorecard-action-single-version.mdCHANGELOG.mdThe overlapping
ARCHITECTURE.mdandCLAUDE.mdchanges were removed because PR #896 owns the authoritative central documentation graph. The unrelated trusted-uv materializer test was restored to protected-main content.Verification boundary
The scope correction changed the exact head, so every earlier check and review is historical. Keep Draft until the unchanged head completes Scorecard, security, SAST, secret, dependency/SBOM, contract-test, and semantic-review gates. The contract must reject any split where the organization-owned Scorecard workflows execute different action SHAs or tags.
Merge gate
After exact-head gates are terminal-success and all valid findings are resolved, mark Ready and require qualifying independent non-author approvals plus the protected-main last-push semantics. No self-approval, stale evidence, administrative bypass, or weakened gate is authorized.