62 Commits
Author SHA1 Message Date
dependabot[bot]andGitHub 6f17a5d8df Bump actions/checkout from 3.2.0 to 3.3.0
Bumps [actions/checkout](https://github.com/actions/checkout) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/755da8c3cf115ac066823e79a1e1788f8940201b...ac593985615ec2ede58e132d2e21d2b1cbd6127c)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-01-09 05:10:46 +00:00
dependabot[bot]andGitHub 1f72dca0ff Bump ossf/scorecard-action from 2.1.0 to 2.1.2
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.1.0 to 2.1.2.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](https://github.com/ossf/scorecard-action/compare/937ffa90d79c7d720498178154ad4c7ba1e4ad8c...e38b1902ae4f44df626f11ba0734b14fb91f8f86)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-12-26 05:08:53 +00:00
W. Felix Handte 150aa23ef4 Pin Remaining Action Dependencies (Except OSS-Fuzz)
The one that isn't pinned is the OSS-Fuzz builder and runner. They don't
offer tagged releases. I could pin to the current master commit, but I'm not
sure how desirable that is.
2022-12-20 17:10:01 -05:00
W. Felix Handte e3f2c8b11c Pin actions/checkout Dependency to Specific Commit Hash
It's a bit silly, because if we can't trust GitHub, what are we doing here?
But OSSF complains about it, so let's fix it.
2022-12-20 14:53:12 -05:00
Felix HandteandGitHub ea199876e2 Merge pull request #3378 from facebook/dependabot/github_actions/github/codeql-action-2.1.37
Bump github/codeql-action from 1.0.26 to 2.1.37
2022-12-20 14:17:33 -05:00
Felix HandteandGitHub 5f0543a508 Merge pull request #3377 from facebook/dependabot/github_actions/ossf/scorecard-action-2.1.0
Bump ossf/scorecard-action from 2.0.6 to 2.1.0
2022-12-20 14:16:10 -05:00
dependabot[bot]andGitHub 79a00f8dcf Bump github/codeql-action from 1.0.26 to 2.1.37
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 1.0.26 to 2.1.37.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5f532563584d71fdef14ee64d17bafb34f751ce5...959cbb7472c4d4ad70cdfe6f4976053fe48ab394)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-12-19 05:07:15 +00:00
dependabot[bot]andGitHub 65545969d5 Bump ossf/scorecard-action from 2.0.6 to 2.1.0
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.0.6 to 2.1.0.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](https://github.com/ossf/scorecard-action/compare/99c53751e09b9529366343771cc321ec74e9bd3d...937ffa90d79c7d720498178154ad4c7ba1e4ad8c)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-12-19 05:07:09 +00:00
dependabot[bot]andGitHub 9730aa4326 Bump actions/upload-artifact from 1 to 3
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 1 to 3.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v1...v3)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-12-08 18:39:58 +00:00
Joyce Brum a8f8dc8c5c fix: upgrade scorecard action to 2.0.6
Signed-off-by: Joyce Brum <joycebrum@google.com>
2022-11-01 14:55:31 -03:00
W. Felix Handte de9a450c00 Restrict from Running on Forks 2022-10-03 11:23:29 -04:00
Felix Handte 79729f8a2d Create scorecards.yml
Addresses #3269.
2022-09-30 14:30:22 -04:00