github ossf/scorecard v5.6.0
on GitHub

2 hours ago

Scorecard Infrastructure Migration

v5.6.0 is the first Scorecard release since our hosted services moved! 🎉

The weekly batch scans and the REST API now run on AboutCode Foundation
infrastructure on AWS, operated in partnership with the Scorecard Steering Committee.

AboutCode is a public-benefit non-profit that already consumes Scorecard data and runs similar
large-scale data services, including PurlDB and
VulnerableCode.

The full announcement is in #5208.

What this means for you:

  • CLI and REST API users: nothing changes. The API endpoint and the tooling are the same.

  • Scorecard Action users: Upgrade to
    v2.5.0 or later. Older versions
    pull images from gcr.io, which has been retired, and will fail.

  • Container images: use ghcr.io/ossf/scorecard. Existing version tags were copied from
    gcr.io/openssf/scorecard with identical digests (v5.5.0 was already published to GHCR), so only
    the registry and namespace change: 

    - gcr.io/openssf/scorecard:<tag>@sha256:<sha>
+ ghcr.io/ossf/scorecard:<tag>@sha256:<sha>

  • BigQuery dataset users: the public dataset is no longer available.

  • Weekly scan inventory: to add a repository to the weekly scans, follow
    ossf/scorecard-infra's contributing guide.
    The pipeline and its project lists moved there.

  • Allstar users: the hosted Allstar GitHub App has been retired. Allstar continues as a
    Scorecard subproject; see the Allstar README for self-hosting.

Report infrastructure problems at ossf/scorecard-infra.

Thank you to AboutCode Foundation for giving Scorecard a new home, and to everyone who reported
migration issues and helped other projects update.

Action Required

  • Workflow checks now read YAML aliases, so Pinned-Dependencies may report more findings. Steps
    reached through an alias (uses: *anchor, aliased run:) were previously skipped and are now
    checked by Pinned-Dependencies, Dangerous-Workflow and the other workflow-based checks. Each
    aliased step counts, so a repository that reuses unpinned actions this way and wasn't already at 0
    can lose score. by @justaugustus in #5287
  • Library users: checks/fileparser signatures changed. Exported workflow helpers
    (GetJobName, AnyJobsMatch, IsPackagingWorkflow and others) now take Scorecard's own workflow
    types instead of github.com/rhysd/actionlint types, and some workflow parse error messages are
    worded differently. by @justaugustus in #5287
  • Library users: cron/ has been removed. cron/data and cron/config are no longer
    importable; the batch-scan pipeline now lives in ossf/scorecard-infra (see Scorecard
    Infrastructure Migration). by @justaugustus in #5210
  • Library users: Go 1.26.5 or later is required (go directive raised from 1.26.0). by
    @justaugustus in #5296

General

  • Release container images are built with Go 1.27.2. by @dependabot[bot] in #5310
  • --format=intoto output is now serialized with protojson, so field names match the in-toto
    specification. by @puerco in #5225
  • On Windows, file paths from GitHub, GitLab and Azure DevOps repositories now use forward slashes,
    matching other platforms. by @pujitha24 in #5153

Azure DevOps

  • Legacy Azure DevOps repository URLs are accepted and normalized to dev.azure.com. by @JamieMagee
    in #5128
  • No workflow runs are returned, without querying every build, when the requested YAML pipeline
    doesn't exist. by @JamieMagee in #5129
  • Language-aware checks fall back to all supported languages when language analytics are
    unavailable. by @JamieMagee in #5130
  • A repository file larger than the archive extraction limit is now rejected instead of silently
    truncated. by @Sahana2524 in #5173

Checks

Packaging

  • ko publishing workflows are detected with either imjasonh/setup-ko or ko-build/setup-ko;
    previously the matcher never fired. by @arcaven in #5134

Pinned-Dependencies

  • Actions referenced from the same repository with GitHub's $/ prefix (for example uses: $/.github/actions/example) are treated like ./ local actions and no longer reported as
    unpinned. by @trask with @Kielek in #5191

Vulnerabilities

  • Python requirements files no longer trigger transitive dependency resolution, which could stall
    the check until it timed out. For library users, clients.ExperimentalLocalOSVClient no longer
    makes network requests for transitive resolution. osv-scanner is updated to v2.5.1. by
    @justaugustus with @adilalperenciftci in #5296
  • Maven dependencies whose version is an unresolved build placeholder (for example
    @project.version@ or ${revision}) are no longer reported. by @justaugustus in
    #5306

Probes

  • The unsafeblock probe also detects Java's sun.misc.Unsafe and jdk.internal.misc.Unsafe
    classes. by @thomasleplus in #4849

Docs

  • 📖 Set GitLab support for Code-Review and Dependency-Update-Tool by @dvcorreia in
    #4963
  • 📖 docs: clarify partial credit logic for Branch-Protection tiers by @aban-alazzeh in
    #5010
  • 📖 Validate Security Insights in CI (and fix the schema) by @justaugustus in
    #5298

Other

Known Issues

  • GitLab: Vulnerabilities returns −1 for every GitLab repository
    (#5056). A fix is planned for v5.7.0
    (#5180).
  • Vulnerabilities: npm bundled dependencies are not checked. Since the osv-scanner update,
    package-lock.json entries without a resolved URL, which includes bundled dependencies, are
    skipped when matching known vulnerabilities. This comes from osv-scalibr; we're following up
    upstream.
  • Pinned-Dependencies: findings reached through a YAML alias point at the anchor's line, not the
    alias. How aliased steps are counted and attributed is tracked in
    #5291.

New Contributors

Full Changelog: v5.5.0...v5.6.0

Check out latest releases or
releases around ossf/scorecard v5.6.0

Don't miss a new scorecard release

NewReleases is sending notifications on new releases.

Get notifications