rpm-ostree: Supplychain scorecard failing on main since 2026-09-02 #56
Description
Source: https://github.com/coreos/rpm-ostree/actions/runs/36019382050
.github/workflows/scorecard.yml pins ossf/scorecard-action@3e15ea8 (tag v1.1.1), which builds from gcr.io/openssf/scorecard:v4.3.1; gcr.io now returns 403. Bump to a current scorecard-action (v2.x, ghcr image) and the matching upload-sarif/SARIF inputs, or drop the workflow. dependabot.yml has no github-actions ecosystem, so nothing will bump it.
Activity
cgwalters-bot commentedon Oct 6, 2026
Stays open: the answer on #245 (accept means post upstream as the bot) is applied through cgwalters-bot/homegit#145, which makes the AI-silent repos bot-ok and waits for cgwalters's approval. This item moves once that merges.
Generated-by: https://github.com/cgwalters/#llms