[renovate]

This PR contains the following updates:

Package	Type	Update	Change
ossf/scorecard-action	action	minor	v2.4.4 → v2.5.0

---

Release Notes

ossf/scorecard-action

v2.5.0

Compare Source

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.

• The action's container image is built with Go 1.27.2 on a refreshed distroless base. by
  @​justaugustus in #​1716
• The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still
  recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in #​1716
• The Scorecard version in results now always matches the Scorecard release the action is built
  with. by @​justaugustus in #​1718
• The action no longer prints the GitHub token variable while validating its options. by
  @​arpitjain099 in #​1709
• results_format accepts intoto, which wraps the JSON results in an in-toto attestation
  statement. by @​puerco in #​1702

Other

• Add a daily canary against Scorecard main by @​justaugustus in #​1711
• Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by @​justaugustus in #​1714
• Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update
  RELEASE.md by @​justaugustus in #​1716
• Bump Scorecard to v5.6.0 by @​justaugustus in #​1719

New Contributors

• @​arpitjain099 made their first contribution in #​1709
• @​puerco made their first contribution in #​1702

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 4279ed4f-4e8d-44c3-8b1f-cb302232392e

📥 Commits

Reviewing files that changed from the base of the PR and between 0e7ae00 and c827b24.

📒 Files selected for processing: 1

• .github/workflows/scorecards.yml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 3 remain after this review.

📝 Walkthrough

The Scorecard workflow now references ossf/scorecard-action v2.5.0 instead of v2.4.4. Other workflow configuration is unchanged.

Changes: Scorecard workflow

Layer / File(s)	Summary
Update Scorecard action pin .github/workflows/scorecards.yml	The workflow action reference changes from the v2.4.4 commit to the v2.5.0 commit.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: acepresso, bohdanmar

Merge Risk: ⚪ Minimal · up to c827b

The workflow update changes the pinned Scorecard Action version; no material merge blocker is evident from the supplied change context.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the main change: updating ossf/scorecard-action to v2.5.0.
Description check		The description directly explains the action version update and includes relevant release notes and configuration details.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Tiny bot-authored Renovate PR updating ossf/scorecard-action by one minor version; the sole CI workflow change and protected path touch elevate the score slightly above low, but minimal blast radius and fully automated provenance keep it at moderate.

[fullsend-ai-review]

Looks good to me

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/scorecards.yml

[fullsend-ai-retro]

Retro: conforma/user-guide PR #274

PR #274 is a Renovate PR authored by app/renovate that bumps the pinned SHA of ossf/scorecard-action from v2.4.4 → v2.5.0 — a single-line change in .github/workflows/scorecards.yml.

Timeline

• 02:09 — Renovate opened the PR and immediately enabled auto-squash merge.
• 02:09 — CodeRabbit reviewed, found no actionable comments, marked merge risk Minimal.
• 02:16 — fullsend-ai-review posted risk assessment moderate (2/5) and the review-agent comment Looks good to me, but noted the workflow file is a protected path and the agent cannot approve. It applied the requires-manual-review and risk/moderate labels.
• 04:52 — Renovate auto-merged the PR with zero human reviews (reviews: [], review_decision: REVIEW_REQUIRED), ~2h 43m after open.

Workflow quality

• The review agent's protected-path judgment was correct: workflow files deserve human scrutiny by default.
• But requires-manual-review had no enforcement effect. GitHub branch protection in this repo does not require an approving review, so the label was advisory while Renovate's auto-merge proceeded. This is not an isolated event — PRs Update conforma/github-workflows digest to ff1126b (main) #273, Update github/codeql-action action to v4.38.3 (main) #272, Update github actions (main) (patch) #270, Update conforma/github-workflows digest to 51213ed (main) #269, Update step-security/harden-runner action to v2.22.0 (main) #268, Update conforma/.fullsend digest to f44ff36 (main) #257, Update github/codeql-action action to v4.38.0 (main) #253, Update conforma/.fullsend digest to cd01138 (main) #250, Update github actions (main) (minor) #235, 🚨 Update github actions to v7 (main) #233 (all bot-authored dependency bumps touching workflow files) show the same requires-manual-review + merged-without-human-review pattern over the last ~six weeks.
• The agent-side cost per PR is non-trivial (risk assessment + review agent runs for every bot PR), with the only observable output being an advisory label.

Candidate findings — judge scores

• 5/5 — requires-manual-review label does not actually block auto-merge: summary-only (duplicate). Covered by open issue fullsend-ai/fullsend#6018, which proposes that the post-review script escalate the verdict to REQUEST_CHANGES when it applies the label. PR Update ossf/scorecard-action action to v2.5.0 (main) #274 is additional supporting evidence; per the retro-filing policy, evidence for an existing issue is summary-only.
• 4/5 — Review-stage cost is wasted on trivial bot-authored action-SHA bumps that will auto-merge regardless: summary-only (duplicate). Covered by open issue fullsend-ai/fullsend#8383 (route trivial bot dependency-bump PRs to a lighter review configuration) and the companion skip proposals #8432 and #8439.
• 4/5 — Protected-path exception for trusted-bot version-only bumps: summary-only (recently closed as not planned). Issue fullsend-ai/fullsend#4387 proposed exactly this and was closed NOT_PLANNED on 2026-09-23. The accepted direction is instead #6018 (make the label enforce) plus #8383 (lighter review for trivial bot bumps).
• 3/5 — Autonomy-readiness evidence: review agent gave a correct Looks good to me on a trivial Renovate action-SHA bump: summary-only (evidence-for). The pattern matches existing tracking issues fullsend-ai/fullsend#4817 and #4962. Per retro-filing policy, supporting evidence for an existing issue must not become an "Evidence for ..." proposal.
• 2/5 — Risk score of moderate (2/5) for a one-line Renovate action patch bump feels inflated: summary-only (calibration, no observed harm). The score pushed the PR into the risk/moderate bucket largely because it touched .github/workflows/. There is no observed downstream consequence beyond the label; this is a calibration preference, not a defect. No existing issue found and the signal is too weak to file.

Proposals filed

None. Every candidate above either duplicates an existing open issue, duplicates a recently-closed NOT_PLANNED issue, is evidence for an existing issue, or scores below the filing threshold.