Skip to content

Releases: ossf/scorecard-action

v2.4.0

26 Jul 16:53
v2.4.0
62b2cac
Compare
Choose a tag to compare

What's Changed

This update bumps the Scorecard version to the v5 release. For a complete list of changes, please refer to the v5.0.0 release notes. Of special note to Scorecard Action is the Maintainer Annotation feature, which can be used to suppress some Code Scanning false positives. Alerts will not be generated for any Scorecard Check with an annotation.

Documentation

New Contributors

Full Changelog: v2.3.3...v2.4.0

v2.3.3

09 May 21:18
v2.3.3
dc50aa9
Compare
Choose a tag to compare

Note

There is no v2.3.2 release as a step was skipped in the release process. This was fixed and re-released under the v2.3.3 tag

What's Changed

  • 🌱 Bump github.com/ossf/scorecard/v4 (v4.13.1) to github.com/ossf/scorecard/v5 (v5.0.0-rc1) by @spencerschrock in #1366
  • 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc1 to v5.0.0-rc2 by @spencerschrock in #1374
  • 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0-rc2.0.20240509182734-7ce860946928 by @spencerschrock in #1377

For a full changelist of what these include, see the v5.0.0-rc1 and v5.0.0-rc2 release notes.

Documentation

Full Changelog: v2.3.1...v2.3.3

v2.3.1

23 Oct 19:49
v2.3.1
0864cf1
Compare
Choose a tag to compare

What's Changed

  • 🌱 Bump github.com/ossf/scorecard/v4 from v4.13.0 to v4.13.1 by @spencerschrock in #1282
    • Adds additional Fuzzing detection and fixes a SAST bug related to detecting CodeQL. For a full changelist of what this includes, see the v4.13.1 release notes

Full Changelog: v2.3.0...v2.3.1

v2.3.0

06 Oct 21:10
v2.3.0
483ef80
Compare
Choose a tag to compare

What's Changed

  • 🌱 Bump github.com/ossf/scorecard/v4 from v4.11.0 to v4.13.0 by @spencerschrock in #1270
    • For a full changelist of what this includes, see the v4.12.0 and v4.13.0 release notes
  • ✨ Send rekor tlog index to webapp when publishing results by @spencerschrock in #1169
  • 🐛 Prevent url clipping for GHES instances by @rajbos in #1225

Documentation

New Contributors

Full Changelog: v2.2.0...v2.3.0

v2.2.0

23 Jun 21:19
v2.2.0
08b4669
Compare
Choose a tag to compare

What's Changed

Scorecard Result Viewer

Thanks to contributions from @cynthia-sg and @tegioz at CLOMonitor, there is a new Scorecard Result visualization page at https://securityscorecards.dev/viewer/?uri=<project-url>.

As an example, you can see our own score visualized here
Checkout our README to learn how to link your README badge to the new visualization page.

Publishing Results

This release contains two fixes which will improve the user experience when publish_results is true

  • Runs that fail our workflow restrictions will fail with a 400 response indicating the problem, instead of a vague 500 status. (#1156, resolved #1150)
  • Scorecard action will retry when signing results and submitting them to our web API. This should help with flakiness from connection failures. (#1191)

Docs

  • 📖 Update README to accept fine-grained tokens by @pnacht in #1175
  • 📖 Update installation instructions to match current GitHub UI by @joycebrum in #1153
  • 📖 Document the GitHub action workflow restrictions when publishing results. by @spencerschrock in

New Contributors

Full Changelog: v2.1.3...v2.2.0

v2.1.3

29 Mar 20:29
v2.1.3
80e868c
Compare
Choose a tag to compare

What's Changed

Bug Fixes

  • Invalid SARIF files from a bug in scorecard
  • Vulnerabilities check crashes if a vulnerable dependency is found via OSVScanner
  • Scorecard action not reporting binary artifacts in the repo

Full Scorecard Changelog: ossf/scorecard@v4.10.2...v4.10.5

Full Changelog: v2.1.2...v2.1.3

v2.1.2

21 Dec 23:20
v2.1.2
e38b190
Compare
Choose a tag to compare

What's Changed

Fixes

  • 🌱 Bump scorecard dependency to v4.10.2 to remove a CODEOWNERS printf statement. by @spencerschrock in #1054

Full Changelog: v2.1.1...v2.1.2

v2.1.1

19 Dec 19:24
15c10fc
Compare
Choose a tag to compare

Scorecard version

This release use Scorecard's v4.10.1

Full Changelog: v2.1.0...v2.1.1

v2.1.0

15 Dec 02:04
937ffa9
Compare
Choose a tag to compare

What's Changed

Scorecard version

This release uses scorecard v4.10.0.

Improvements

Documentation

New Contributors

Full Changelog: v2.0.6...v2.1.0

v2.0.6

19 Oct 00:40
v2.0.6
99c5375
Compare
Choose a tag to compare

What's Changed

Full Changelog: v2.0.5...v2.0.6