[workflows] Update the version of the scorecard-action

[tstellar]

I'm hoping this will fix the errors we've been seeing the last few days:

2024-03-19T20:44:07.4841482Z 2024/03/19 20:44:07 error signing scorecard json results: error signing payload: getting key from Fulcio: verifying SCT: updating local metadata and targets: error updating to TUF remote mirror: invalid key

[tstellar]

@diogoteles08

[llvmbot]

@llvm/pr-subscribers-github-workflow

Author: Tom Stellard (tstellar)

Changes

I'm hoping this will fix the errors we've been seeing the last few days:

2024-03-19T20:44:07.4841482Z 2024/03/19 20:44:07 error signing scorecard json results: error signing payload: getting key from Fulcio: verifying SCT: updating local metadata and targets: error updating to TUF remote mirror: invalid key

---

Full diff: https://github.com/llvm/llvm-project/pull/86753.diff

1 Files Affected:

• (modified) .github/workflows/scorecard.yml (+1-1)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b8e8ab26c3ffa6..ff61cf83a6af3c 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -36,7 +36,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # v2.1.2
+        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
         with:
           results_file: results.sarif
           results_format: sarif

[boomanaiden154]

I don't think it would hurt to land this and see if it helps? Updating the action either way doesn't seem like a bad idea...

[diogoteles08]

@diogoteles08

Hi! Thanks for mentioning me.

Yeah, this update will fix it. The error happened because Scorecard uses Sigstore tool to sign its results and Sigstore has done an update (https://blog.sigstore.dev/tuf-root-update/) that is not compatible with older Scorecard versions (for example, v.2.1.2 used here). But Scorecard v2.3.1 is compatible with Sigstore changes and should get back to work smoothly =)