From 780673e8f51cf5ab5c415ecda5dbd690351cc07b Mon Sep 17 00:00:00 2001 From: Sajadlance Date: Mon, 4 May 2026 22:18:33 +0300 Subject: [PATCH] ci: pin scorecard-action to v2.4.3 and drop unresolved dependabot labels ossf/scorecard-action does not publish a floating v2 major-version tag; its release tags are minor.patch only. Pinning to v2.4.3 (the current latest stable, released 2024-09-30, runs Scorecard v5.3.0). Removed the labels: field from both Dependabot ecosystems. The "dependencies" and "github-actions" labels did not exist on the repo and Dependabot does not auto-create them. Filtering by the commit-message prefixes (deps:, deps-dev:, ci:) and by author (dependabot[bot]) covers the same use case without requiring repo-side label setup. --- .github/dependabot.yml | 5 ----- .github/workflows/scorecard.yml | 2 +- 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index bd47c7c..77356b1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -15,8 +15,6 @@ updates: prefix: "deps" prefix-development: "deps-dev" include: "scope" - labels: - - "dependencies" groups: typescript-eslint: patterns: @@ -53,9 +51,6 @@ updates: commit-message: prefix: "ci" include: "scope" - labels: - - "dependencies" - - "github-actions" groups: actions: patterns: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 2696eae..13c35fe 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -29,7 +29,7 @@ jobs: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@v2 + uses: ossf/scorecard-action@v2.4.3 with: results_file: results.sarif results_format: sarif