Merge branch 'main' into auto-branch-find

Author: spencerschrock

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @ossf/scorecard-maintainers

.github/dependabot.yml

@@ -7,22 +7,27 @@ updates:
       interval: daily
     commit-message:
       prefix: ":seedling:"
-    reviewers:
-      - "ossf/scorecard-maintainers"
     open-pull-requests-limit: 10
     groups:
+      gomod:
+        patterns:
+          - "*"
+        exclude-patterns:
+          - "github.com/go-openapi/*"
+          - "golang.org/x/*"
       go-openapi:
         patterns:
           - "github.com/go-openapi/*"
+      golang-x:
+        patterns:
+          - "golang.org/x/*"
   # For the website code in scorecards-site.
   - package-ecosystem: npm
-    directory: '/'
+    directory: '/scorecards-site'
     schedule:
       interval: daily
       time: '00:00'
     open-pull-requests-limit: 10
-    reviewers:
-      - "ossf/scorecard-maintainers"
     commit-message:
       prefix: fix
       prefix-development: chore
@@ -34,19 +39,26 @@ updates:
       interval: "weekly"
     commit-message:
       prefix: ":seedling:"
-    reviewers:
-      - "ossf/scorecard-maintainers"
     groups:
       github-actions:
         patterns:
           - "*"
+        exclude-patterns:
+          - "actions/*"
+          - "github/*"
+          - "golangci/*"
+      github-owned:
+        patterns:
+          - "actions/*"
+          - "github/*"
+      golangci:
+        patterns:
+          - "golangci/*"
   # Dockerfiles
   - package-ecosystem: docker
     directory: "/"
     schedule:
       interval: "weekly"
     commit-message:
       prefix: ":seedling:"
-    reviewers:
-      - "ossf/scorecard-maintainers"
     open-pull-requests-limit: 10

.github/workflows/codeql-analysis.yml

@@ -31,11 +31,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@883d8588e56d1753a8a58c1c86e88976f0c23449
+      uses: github/codeql-action/init@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -46,7 +46,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@883d8588e56d1753a8a58c1c86e88976f0c23449
+      uses: github/codeql-action/autobuild@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -60,4 +60,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@883d8588e56d1753a8a58c1c86e88976f0c23449
+      uses: github/codeql-action/analyze@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8

.github/workflows/depsreview.yml

@@ -22,6 +22,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c
+        uses: actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a

.github/workflows/main.yml

@@ -27,7 +27,8 @@ on:
 
 env:
   PROTOC_VERSION: 3.17.3
-  GO_VERSION: 1.23
+  GO_VERSION: 1.24
+  GOLANGCI_LINT_VERSION: v1.64.8
 
 jobs:
   build-scorecard-webapp:
@@ -37,17 +38,18 @@ jobs:
       contents: read
     steps:
      - name: Clone the code
-       uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+       uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
           fetch-depth: 0
      - name: Setup Go
-       uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
+       uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Run linter
-       uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # v6.1.0
+       uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
        with:
          args: --config=.golangci.yml
+         version: ${{ env.GOLANGCI_LINT_VERSION }}
      - name: Check license headers
        run: |
           go env -w GOFLAGS=-mod=mod

.github/workflows/scorecards-analysis.yml

@@ -20,12 +20,12 @@ jobs:
       id-token: write
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v2.4.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.0.3
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.0.3
         with:
           results_file: results.sarif
           results_format: sarif
@@ -48,6 +48,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@883d8588e56d1753a8a58c1c86e88976f0c23449 # v1.0.26
+        uses: github/codeql-action/upload-sarif@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
         with:
           sarif_file: results.sarif

.golangci.yml

@@ -1,7 +1,7 @@
 ---
 run:
   concurrency: 6
-  deadline: 5m
+  timeout: 5m
 issues:
   include:
     # revive `package-comments` and `exported` rules.
@@ -18,15 +18,13 @@ issues:
   # Default: 3
   max-same-issues: 0
   new-from-rev: ""
-skip-files:
-  - cron/data/request.pb.go # autogenerated
 linters:
   disable-all: true
   enable:
     - asciicheck
+    - copyloopvar
     - dogsled
     - exhaustive
-    - exportloopref
     - gci
     - gochecknoinits
     - goconst

Dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.23.1@sha256:2fe82a3f3e006b4f2a316c6a21f62b66e1330ae211d039bb8d1128e12ed57bf1 AS builder
+FROM golang:1.25.2@sha256:1c91b4f4391774a73d6489576878ad3ff3161ebc8c78466ec26e83474855bfcf AS builder
 ENV APP_ROOT=/opt/app-root
 ENV GOPATH=$APP_ROOT
 
@@ -25,7 +25,7 @@ ARG TARGETARCH
 RUN CGO_ENABLED=0 make scorecard-webapp
 
 # Multi-Stage production build
-FROM golang:1.23.1@sha256:2fe82a3f3e006b4f2a316c6a21f62b66e1330ae211d039bb8d1128e12ed57bf1 as deploy
+FROM golang:1.25.2@sha256:1c91b4f4391774a73d6489576878ad3ff3161ebc8c78466ec26e83474855bfcf as deploy
 # Retrieve the binary from the previous stage
 COPY --from=builder /opt/app-root/src/scorecard-webapp /usr/local/bin/scorecard-webapp
 

app/server/badge.go

@@ -29,7 +29,7 @@ import (
 
 const (
 	shieldsURL   = "https://img.shields.io/ossf-scorecard"
-	badgeLabel   = "openssf scorecard"
+	badgeLabel   = "openssf+scorecard"
 	defaultStyle = "flat"
 )
 

app/server/get_results_test.go

@@ -71,7 +71,6 @@ func TestSanitizePath(t *testing.T) {
 		},
 	}
 	for _, tt := range testcases {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			gotPath, gotErr := sanitizeInputs(tt.host, tt.orgName, tt.repoName, tt.commit)