chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4

[dependabot]

Bumps ossf/scorecard-action from 2.4.3 to 2.4.4.

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.4

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

• log POST failures instead of failing entire action by @​spencerschrock in ossf/scorecard-action#1625

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

Commits

• 2d11466 Bump action tag for v2.4.4 release (#1688)
• 1bd3285 🌱 Bump the docker-images group across 1 directory with 2 updates (#1...
• 913edce 🌱 Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (#1671)
• 0957b8f 🌱 Bump golang.org/x/net from 0.56.0 to 0.57.0 (#1680)
• f0061eb 🌱 Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#1687)
• 20ee732 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 (#1685)
• 9f295ef 🌱 Bump the github-actions group with 6 updates (#1686)
• 69bf556 🌱 Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 (#1681)
• 94e8b96 🌱 Bump github.com/sigstore/rekor from 1.5.0 to 1.5.2 (#1673)
• c7a1b37 🌱 Bump github.com/sigstore/fulcio from 1.8.5 to 1.8.6 (#1675)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[srpatcha]

Approving. Target verified against the upstream release list, and the two red
checks are pre-existing.

The failing checks are not this PR

Lint & Format and Quick Checks fail on all five open Dependabot PRs
identically, and on master. Reproduced locally against master:

$ ruff check eosim/
Found 324 errors.

$ ruff format --check eosim/
178 files would be reformatted, 15 files already formatted

So the lint gate has been red for some time and every PR inherits it. That is
worth someone's attention on its own — a permanently red required-adjacent check
trains people to ignore it, which is how a real failure gets waved through — but
it is not a reason to hold a version bump.

Verified

All five targets in this batch exist and are current:

docker/setup-qemu-action    v4       latest v4.2.0
actions/checkout            v7       latest v7.0.1
ossf/scorecard-action       v2.4.4   latest v2.4.4
actions/download-artifact   v8       latest v8.0.1
actions/github-script       v9       latest v9.0.0

I check these rather than assume Dependabot picked a real tag — worth doing,
since a bump to a tag that does not exist fails at runtime with a confusing
error rather than at review.

EoSim is also one of the repositories whose ci.yml is correctly configured
(branches: [master, main, develop]), so unlike six of its siblings its CI
actually runs on pull requests. That is why these PRs have real check results at
all.

[srpatcha]

Review — EoSim#23 "chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4"

head: 5995a7e author: app/dependabot ci: fail (Lint & Format, Quick Checks — pre-existing on master, not caused by this PR)

Verdict: A single-line patch bump with no input changes; safe to land. One thing in it deserves to be read rather than waved through: 2.4.4's only behavioural change makes a previously-fatal publish failure non-fatal, and scorecard.yml:33 sets publish_results: true, so it applies here directly. That is a deliberate upstream loosening, not a defect in this PR, but the maintainer should know they are accepting it. Same CI-integrity caveats as EoSim#21.

Findings

#	Severity	File:line	Finding	Recommended fix
1	High	.github/workflows/ci.yml:263-278, repo branch protection, .github/workflows/ci.yml:226	The three pre-existing CI-integrity defects detailed with evidence in the EoSim#21 review apply identically: ci-summary cannot fail (it reported pass in 3s on this PR while lint failed and six jobs were skipped), master has required_status_checks: null, and pip-audit --strict 2>/dev/null || true makes Security Scan report success unconditionally. Not introduced by this diff.	See the EoSim#21 review for the ordered fix.
2	Low	.github/workflows/scorecard.yml:29,33	2.4.4's only functional change is upstream PR ossf/scorecard-action#1625, "log POST failures instead of failing entire action". This workflow sets publish_results: true (:33), so after this bump a failure to publish to the OpenSSF API degrades from a red job to a log line. That is the right call for a badge-publishing step and I am not arguing against it — but .github/STANDARDS.md lists OpenSSF Scorecard under Security and its compliance rule requires "running the verifying workflow on every push". After this bump, a silently-not-publishing Scorecard workflow still shows green, so the README claim stops being self-evidencing.	Land it. Separately, if the Scorecard result is load-bearing for the README's Security claim, add a check that the expected SARIF was produced — github/codeql-action/upload-sarif@v3 at :35 already consumes results.sarif, so failing when that file is absent or empty is a two-line guard.
3	Low	.github/workflows/scorecard.yml:3-5	scorecard.yml triggers on schedule: cron "0 6 * * 1" only. The changed line cannot execute on this PR, or on merge — the first run of scorecard-action@v2.4.4 in this repo will be a Monday 06:00 cron tick. The two red checks on this PR come from ci.yml and pr-check.yml and have nothing to do with the file it edits.	Merge decision only. workflow_dispatch it once after merge if you want signal before Monday.
4	Medium	CI state — Lint & Format, Quick Checks	Both red on pre-existing ruff violations in eosim/ (eosim/plugins/loader.py:4 I001, eosim/tests/runner.py:45,50 UP031, eosim/tests/scenarios.py:43,54,58 UP031, plus the wider F401/N806 set in Quick Checks), unrelated to this diff. Every job declaring needs: lint was skipped. master is red on lint and every EoSim PR inherits it.	Land a ruff check --fix / ruff format pass on master. Do not ask a dependabot patch bump to carry it.

Not a finding, recorded as checked. 2.4.3 → 2.4.4 rolls Scorecard itself from v5.3.x to v5.5.0. No input was added, renamed or removed; scorecard.yml:29-33 passes results_file, results_format and publish_results, all unchanged. The job's permissions: block (id-token: write at :22 under a repo-wide permissions: read-all at :10) is untouched by this diff and is still what the action requires — this bump does not widen any permission.

Architecture conformance

Conforms. Infrastructure-tier change (master design §21) to a Tier-1 Foundation repository. No source, #include, link line or manifest entry — §5.1 dependency direction untouched. Finding 2 sits against .github/STANDARDS.md §"Standards-compliance assertions" rather than against the master design; the underlying "a green check that verified nothing" question is already filed as the §28.2 proposal of 2026-09-02, and this instance is milder than the ones it cites. No new proposal warranted.

Proposed changes

None to the diff. Repository order of operations is in the EoSim#21 review.

Verification I ran

• git show origin/master:.github/workflows/scorecard.yml → trigger is schedule only; publish_results: true at :33; permissions: read-all at :10 with id-token: write at :22; SARIF consumed at :35. This is what makes findings 2 and 3 concrete rather than generic.
• Read the 2.4.4 release notes from the PR body: one change, ossf/scorecard-action#1625, plus the Scorecard v5.4.0/v5.5.0 rollup.
• gh run view --job 99405013134 --log-failed (Lint & Format) and --job 99405013285 (Quick Checks) → the ruff violations in finding 4.
• gh api repos/embeddedos-org/EoSim/branches/master/protection → required_status_checks: null.
• gh pr view 23 --json mergeStateStatus,reviewDecision,mergeable → UNSTABLE APPROVED MERGEABLE.

Not checked

• Nothing was executed. scorecard.yml did not run on this PR and cannot until a cron tick or manual dispatch. I have not observed scorecard-action@v2.4.4 working in this repository.
• I did not read the Scorecard v5.4.0/v5.5.0 release notes in full, so I make no statement about whether the new Scorecard version changes any check score — only that the action's inputs and failure behaviour are as described above. A score change is possible and would show up as a moved badge, not as a broken workflow.
• The local EoSim checkout is dirty (179 modified tracked .pyc files) and two commits behind origin/master; the sync step correctly left it alone and everything above was read from origin/master. I did not stash, reset or check out anything.

---

Automated architecture review of 5995a7e23263 — scheduled, model claude-opus-5, checked against the EmbeddedOS Master Design v2.0. Advisory only: this reviewer never approves, requests changes, or merges. Reply here to discuss or push back — a wrong finding is a bug worth reporting.