chore(deps): update github actions upgrade

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	minor	v4.1.1 -> v4.2.2
actions/upload-artifact	action	digest	97a0fba -> ff15f03
google/osv-scanner-action	action	minor	v1.7.1 -> v1.9.0
ossf/scorecard-action	action	minor	v2.3.1 -> v2.4.0
taiki-e/install-action	action	digest	cdcde4a -> 678b06b

---

Release Notes

actions/checkout (actions/checkout)

v4.2.2

Compare Source

• url-helper.ts now leverages well-known environment variables by @​jww3 in https://github.com/actions/checkout/pull/1941
• Expand unit test coverage for isGhes by @​jww3 in https://github.com/actions/checkout/pull/1946

v4.2.1

Compare Source

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in https://github.com/actions/checkout/pull/1924

v4.2.0

Compare Source

• Add Ref and Commit outputs by @​lucacome in https://github.com/actions/checkout/pull/1180
• Dependency updates by @​dependabot- https://github.com/actions/checkout/pull/1777, https://github.com/actions/checkout/pull/1872

v4.1.7

Compare Source

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in https://github.com/actions/checkout/pull/1739
• Bump actions/checkout from 3 to 4 by @​dependabot in https://github.com/actions/checkout/pull/1697
• Check out other refs/* by commit by @​orhantoy in https://github.com/actions/checkout/pull/1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in https://github.com/actions/checkout/pull/1776

v4.1.6

Compare Source

• Check platform to set archive extension appropriately by @​cory-miller in https://github.com/actions/checkout/pull/1732

v4.1.5

Compare Source

What's Changed

• Update NPM dependencies by @​cory-miller in https://github.com/actions/checkout/pull/1703
• Bump github/codeql-action from 2 to 3 by @​dependabot in https://github.com/actions/checkout/pull/1694
• Bump actions/setup-node from 1 to 4 by @​dependabot in https://github.com/actions/checkout/pull/1696
• Bump actions/upload-artifact from 2 to 4 by @​dependabot in https://github.com/actions/checkout/pull/1695
• README: Suggest user.email to be 41898282+github-actions[bot]@​users.noreply.github.com by @​cory-miller in https://github.com/actions/checkout/pull/1707

Full Changelog: actions/checkout@v4.1.4...v4.1.5

v4.1.4

Compare Source

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in https://github.com/actions/checkout/pull/1692
• Add dependabot config by @​cory-miller in https://github.com/actions/checkout/pull/1688
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in https://github.com/actions/checkout/pull/1693
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in https://github.com/actions/checkout/pull/1643

v4.1.3

Compare Source

What's Changed

• Update actions/checkout version in update-main-version.yml by @​jww3 in https://github.com/actions/checkout/pull/1650
• Check git version before attempting to disable sparse-checkout by @​jww3 in https://github.com/actions/checkout/pull/1656
• Add SSH user parameter by @​cory-miller in https://github.com/actions/checkout/pull/1685

Full Changelog: actions/checkout@v4.1.2...v4.1.3

v4.1.2

Compare Source

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in https://github.com/actions/checkout/pull/1598

google/osv-scanner-action (google/osv-scanner-action)

v1.9.0

Compare Source

What's Changed

• chore(deps): update workflows by @​renovate-bot in https://github.com/google/osv-scanner-action/pull/40
• chore(deps): update github/codeql-action action to v3.26.7 by @​renovate-bot in https://github.com/google/osv-scanner-action/pull/43
• chore(deps): update workflows by @​renovate-bot in https://github.com/google/osv-scanner-action/pull/44
• chore(deps): update github/codeql-action action to v3.26.10 by @​renovate-bot in https://github.com/google/osv-scanner-action/pull/45
• Update to v1.9.0 by @​michaelkedar in https://github.com/google/osv-scanner-action/pull/46

New Contributors

• @​michaelkedar made their first contribution in https://github.com/google/osv-scanner-action/pull/46

Full Changelog: google/osv-scanner-action@v1.8.5...v1.9.0

v1.8.5

Compare Source

This updates OSV-Scanner to v1.8.5.

What's Changed

• chore(deps): update workflows by @​renovate-bot in https://github.com/google/osv-scanner-action/pull/34
• fix: Use force checkout on second checkout for PR scanning by @​another-rex in https://github.com/google/osv-scanner-action/pull/41
• chore: update to v1.8.5 by @​cuixq in https://github.com/google/osv-scanner-action/pull/42

New Contributors

• @​cuixq made their first contribution in https://github.com/google/osv-scanner-action/pull/42

Full Changelog: google/osv-scanner-action@v1.8.4...v1.8.5

v1.8.4

Compare Source

Bump OSV-Scanner version https://github.com/google/osv-scanner/releases/tag/v1.8.4

v1.8.3

Compare Source

What's Changed

• Now uses OSV-Scanner v1.8.3, see https://github.com/google/osv-scanner/blob/main/CHANGELOG.md for full changelog.

New Contributors

• @​hogo6002 made their first contribution in https://github.com/google/osv-scanner-action/pull/37

Full Changelog: google/osv-scanner-action@v1.8.2...v1.8.3

v1.8.2

Compare Source

What's Changed

• Now uses OSV-Scanner v1.8.2, see https://github.com/google/osv-scanner/blob/main/CHANGELOG.md for full changelog.
• Call analysis is now done by default for golang.

v1.8.1

Compare Source

v1.7.4

Compare Source

v1.7.3

Compare Source

What's Changed

• Branches filter is not available for merge_group by @​thomasleplus in https://github.com/google/osv-scanner-action/pull/15
• Update to track osv-scanner v1.7.3 by @​another-rex in https://github.com/google/osv-scanner-action/pull/17

New Contributors

• @​shahar-h made their first contribution in https://github.com/google/osv-scanner-action/pull/8
• @​thomasleplus made their first contribution in https://github.com/google/osv-scanner-action/pull/15

Full Changelog: google/osv-scanner-action@v1.7.1...v1.7.3

ossf/scorecard-action (ossf/scorecard-action)

v2.4.0

Compare Source

What's Changed

This update bumps the Scorecard version to the v5 release. For a complete list of changes, please refer to the v5.0.0 release notes. Of special note to Scorecard Action is the Maintainer Annotation feature, which can be used to suppress some Code Scanning false positives. Alerts will not be generated for any Scorecard Check with an annotation.

• 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1410
• 🐛 lower license sarif alert threshold to 9 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1411

Documentation

• docs: dogfooding badge by @​jkowalleck in https://github.com/ossf/scorecard-action/pull/1399

New Contributors

• @​jkowalleck made their first contribution in https://github.com/ossf/scorecard-action/pull/1399

Full Changelog: ossf/scorecard-action@v2.3.3...v2.4.0

v2.3.3

Compare Source

[!NOTE]
There is no v2.3.2 release as a step was skipped in the release process. This was fixed and re-released under the v2.3.3 tag

What's Changed

• 🌱 Bump github.com/ossf/scorecard/v4 (v4.13.1) to github.com/ossf/scorecard/v5 (v5.0.0-rc1) by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1366
• 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc1 to v5.0.0-rc2 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1374
• 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0-rc2.0.20240509182734-7ce860946928 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1377

For a full changelist of what these include, see the v5.0.0-rc1 and v5.0.0-rc2 release notes.

Documentation

• 📖 Move token discussion out of main README. by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1279
• 📖 link to ossf/scorecard workflow instead of maintaining an example by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1352
• 📖 update api links to new scorecard.dev site by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1376

Full Changelog: ossf/scorecard-action@v2.3.1...v2.3.3

v2.3.2

Compare Source

---

Configuration

📅 Schedule: Branch creation - "after 9am and before 5pm on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.