Update ossf/scorecard-action action to v2.4.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
ossf/scorecard-action	action	minor	v2.3.3 -> v2.4.0

---

Release Notes

ossf/scorecard-action (ossf/scorecard-action)

v2.4.0

Compare Source

What's Changed

This update bumps the Scorecard version to the v5 release. For a complete list of changes, please refer to the v5.0.0 release notes. Of special note to Scorecard Action is the Maintainer Annotation feature, which can be used to suppress some Code Scanning false positives. Alerts will not be generated for any Scorecard Check with an annotation.

• 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1410
• 🐛 lower license sarif alert threshold to 9 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1411

Documentation

• docs: dogfooding badge by @​jkowalleck in https://github.com/ossf/scorecard-action/pull/1399

New Contributors

• @​jkowalleck made their first contribution in https://github.com/ossf/scorecard-action/pull/1399

Full Changelog: ossf/scorecard-action@v2.3.3...v2.4.0

---

Configuration

📅 Schedule: Branch creation - "* 0-4 * * 3" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

[puLL-Merge] - ossf/scorecard-action@v2.3.3..v2.4.0

Description

This pull request updates various dependencies and makes minor changes to the project configuration. The main motivation appears to be keeping the project up-to-date with the latest versions of its dependencies and making small adjustments to the build process and policies.

Changes

Changes

1. .github/workflows/codeql-analysis.yml:

   • Updated versions of actions/checkout, github/codeql-action/init, github/codeql-action/autobuild, and github/codeql-action/analyze

2. .github/workflows/dependency-review.yml:

   • Updated versions of step-security/harden-runner, actions/checkout, and actions/dependency-review-action

3. .github/workflows/docker-image.yml:

   • Updated version of actions/checkout

4. .github/workflows/golangci.yml:

   • Updated versions of actions/checkout, actions/setup-go, and golangci/golangci-lint-action

5. .github/workflows/scorecards.yml:

   • Updated versions of actions/checkout, actions/upload-artifact, and github/codeql-action/upload-sarif

6. .github/workflows/tests.yaml:

   • Updated versions of actions/checkout and actions/setup-go

7. Dockerfile:

   • Updated base image versions for golang and gcr.io/distroless/base

8. Makefile:

   • Updated LDFLAGS with new version and commit hash

9. README.md:

   • Added OpenSSF Scorecard badge

10. action.yaml:

    • Updated docker image version to v2.4.0

11. go.mod and go.sum:

    • Numerous dependency updates, including major version updates for some packages

12. policies/template.yml:

    • Changed the License policy score from 10 to 9

Possible Issues

The change in the License policy score from 10 to 9 in the template.yml file might affect the project's compliance or scoring system. This change should be reviewed to ensure it aligns with the project's goals and requirements.

Security Hotspots

No significant security hotspots were identified in this change. However, as with any dependency update, it's important to ensure that the new versions don't introduce any known vulnerabilities.