chore(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 in the actions group

[dependabot]

Bumps the actions group with 1 update: ossf/scorecard-action.

Updates ossf/scorecard-action from 2.4.4 to 2.5.0

Release notes

Sourced from ossf/scorecard-action's releases.

v2.5.0

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the Scorecard v5.6.0 release notes.

• The action's container image is built with Go 1.27.2 on a refreshed distroless base. by @​justaugustus in ossf/scorecard-action#1716
• The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in ossf/scorecard-action#1716
• The Scorecard version in results now always matches the Scorecard release the action is built with. by @​justaugustus in ossf/scorecard-action#1718
• The action no longer prints the GitHub token variable while validating its options. by @​arpitjain099 in ossf/scorecard-action#1709
• results_format accepts intoto, which wraps the JSON results in an in-toto attestation statement. by @​puerco in ossf/scorecard-action#1702

Other

• Add a daily canary against Scorecard main by @​justaugustus in ossf/scorecard-action#1711
• Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by @​justaugustus in ossf/scorecard-action#1714
• Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update RELEASE.md by @​justaugustus in ossf/scorecard-action#1716
• Bump Scorecard to v5.6.0 by @​justaugustus in ossf/scorecard-action#1719

New Contributors

• @​arpitjain099 made their first contribution in ossf/scorecard-action#1709
• @​puerco made their first contribution in ossf/scorecard-action#1702

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

Commits

• fa7117d Bump action tag for v2.5.0 release (#1720)
• cef4eb5 🌱 Bump Scorecard to v5.6.0 (#1719)
• bedb16e ✨ Add intoto results format (#1702)
• de70347 Remove the leftover debug print of the auth token (#1709)
• 950873d 🌱 Derive the reported Scorecard version from go.mod (#1718)
• 2ce8ee4 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (#1695)
• aabdf5a 🌱 Bump the github-actions group across 1 directory with 7 updates (#...
• b4b9adf 🌱 CodeQL: Analyze workflows instead of a placeholder JavaScript file
• 4e9f2a2 📖 RELEASE.md: Document drafting release notes
• f618e8b 🌱 Build the image with Go 1.27.2 and refresh distroless
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

✅ PR Validation Passed

All checks passed!

---

📋 Pipeline Status

	Job	Status
✅	🔢 Version	passing
✅	🏗️ Build	passing
✅	🧪 Tests	passing
✅	📝 Lint	passing
✅	📘 TypeCheck	passing
✅	🔐 Security Audit	passing
✅	🧾 Conventional Commits	passing
✅	🔗 Coherency	passing

---

📊 Code Coverage

✅ Overall Coverage: 100.0% — Target reached! 🎯

	Metric	Progress	Coverage
✅	Lines	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓	100%
✅	Branches	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓	100%
✅	Functions	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓	100%
✅	Statements	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓	100%

---

🧬 Mutation Testing

⏭️ Mutation Testing: skipped

---

🌐 Runtime Compatibility

✅ Runtime Compatibility: 3/3 — All runtimes passed!

	Runtime	Status
🟩	Node.js 26 (LTS) v26.11.1	✅
🦕	Deno 2.8.3	✅
🍞	Bun 1.4.3	✅

🔄 Runtime compatibility is informational only and does not block the PR

---

⏱️ Benchmarks

⏭️ Benchmarks: skipped

---

ℹ️ About this report

• 🎯 Coverage Target: 100% for all metrics
• 🧬 Mutation Testing: powered by Stryker (non-blocking)
• ⏱️ Benchmarks: powered by Vitest Bench (non-blocking)
• 🔄 This comment updates automatically with each push
• 📈 Coverage is measured using Vitest + v8

---

_{🤖 Generated by @helpers4 CI • 2026-10-14}

[baxyz]

@dependabot rebase

[dependabot]

Looks like ossf/scorecard-action is updatable in another way, so this is no longer needed.