ci: update OpenSSF Scorecard action to v2.4.4

[ajitpratap0]

Summary

• bump ossf/scorecard-action from v2.4.0 to v2.4.4
• restore Scorecard execution by moving from the retired gcr.io image used by v2.4.0 to the ghcr.io image published by v2.4.4

Validation

• parsed .github/workflows/scorecard.yml successfully as YAML
• passed actionlint v1.7.12
• verified v2.4.4 is the latest non-prerelease and its action metadata references ghcr.io/ossf/scorecard-action:v2.4.4
• independent diff review passed with no findings

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
gosqlx-website	Ready	Preview	Oct 10, 2026 5:17pm UTC

[github-actions]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[github-actions]

Claude finished @ajitpratap0's task —— View job

---

PR Review: ci: update OpenSSF Scorecard action to v2.4.4

• Review workflow diffs
• Review go.mod / go.sum
• Review vscode-extension changes
• Build/vet check (not run, see notes)
• Post review

---

Summary

The scorecard.yml change is small and correct. It bumps ossf/scorecard-action from v2.4.0 to v2.4.4, which moves the image from the retired gcr.io to ghcr.io. The PR also carries unrelated changes in the second commit (2206e8f), and the PR title and description don't mention them.

Scope mismatch (main feedback)

The title and body describe only the Scorecard bump. The PR also contains:

• Claude workflows (claude.yml, claude-code-review.yml) now pin model: "claude-sonnet-5-5".
• Go dependency bumps in go.mod / go.sum: x/term, x/crypto, x/sys, klauspost/compress, moby/*, logrus, plus transitive x/net and x/text.
• VS Code extension: a brace-expansion override bump.

The commit message says these fix new Trivy CVEs and a retired review model, which is a reasonable motivation. Please either update the title and description to say so or split them out. This matters for git blame/revert, and for the [verified] first commit, since the squash would hide the CVE fix behind a Scorecard title.

Code quality and correctness

.github/workflows/scorecard.yml

• The change is fine.
• Pinning the action to a full commit SHA instead of the tag @v2.4.4 would improve the Scorecard score on its own "Pinned-Dependencies" check. Scorecard itself recommends this. The repo may already use tags elsewhere, so this is optional.

claude.yml / claude-code-review.yml

• The model is pinned explicitly, which is better than relying on the action's retired default.
• The new comment reads as a durable explanation, but it will go stale when this model is retired as well. Consider centralizing the model name (e.g. a repo variable vars.CLAUDE_MODEL) so the next retirement is a one-line settings change, not edits in two files.
• Please confirm claude-sonnet-5-5 is a valid ID for your claude-code-action version. A wrong ID fails every review run, and the earlier run on this PR (27 Sep) errored.

go.mod / go.sum

• The go.sum diff is consistent with the go.mod bumps.
• go.sum gains moby/sys/mount and moby/sys/mountinfo. These are not in go.mod, so they come from the moby/go-archive v0.3.3 dependency graph.
• Several stale /go.mod-only hashes were removed, which is normal go mod tidy output.
• The bumped packages (x/crypto, x/sys, x/term, logrus, compress) are all // indirect or test-only (testcontainers). They don't affect production runtime behavior.
• I couldn't run go build ./..., go vet, or go mod verify in this environment (the commands needed approval), so I haven't verified the build. Please confirm the CI build and race tests are green, especially task test:race, since golang.org/x/sys and compress are widely used.

vscode-extension/package.json / package-lock.json

• The overrides entry is ^5.0.9 while the lockfile resolves 5.0.12. That's consistent, since 5.0.12 satisfies the range.
• The package.json file still has no trailing newline. That was already the case, so it's not a regression.

Security

• Moving off the retired gcr.io image restores supply-chain scanning and is a net positive.
• The dependency bumps address Trivy findings, as the commit message says. I'd suggest linking the specific CVE IDs in the description for auditability.
• No secrets or new permissions were introduced. persist-credentials: false is retained in the Scorecard checkout.

Performance and test coverage

• Not applicable. There are no runtime or parser changes, and no Go source files were modified. CI results are the right validation here.

Verdict

The changes look good. Before merging, I'd suggest:

1. Update the PR title and description to cover the Trivy CVE fixes and the model pin.
2. Confirm the CI checks are green, including race tests and the Trivy scan.
3. Optionally pin scorecard-action by SHA.

--- | Branch: ci/scorecard-action-v2.4.4

[github-actions]

Claude finished @ajitpratap0's task —— View job

---

PR Review: ci: update OpenSSF Scorecard action to v2.4.4 (re-review after 1267fe9)

• Review latest commit diff (setup-go changes)
• Check consistency with go.mod and other workflows
• Post review

---

What changed since the last review

Commit 1267fe9 adds check-latest: true to all 16 actions/setup-go@v5 steps across 8 workflows. The cached runner Go (1.26.8) was being used for go-version: '1.26', and govulncheck flagged net/http CVEs fixed in 1.26.9. The change is correct and consistent. I found every setup-go step in .github/workflows and each one has the flag, so none were missed.

Feedback

Correctness

• check-latest: true makes setup-go check the Go release manifest and download the newest 1.26.x when the cached version is older. That fixes the root cause of the govulncheck failures.
• go.mod declares go 1.26.1, so any 1.26.x resolved here satisfies it.
• The test job sets GOTOOLCHAIN: local (test.yml:41), so the toolchain setup-go installs is the one that runs. With check-latest, the Windows and macOS legs also get 1.26.9+. This combination is good.

Trade-offs to be aware of

• Reproducibility: CI Go versions now float with upstream patch releases. That is the intended outcome for a security-sensitive project, but a new patch release can occasionally break or change behavior in a PR you didn't touch. If that happens, pin to the specific patch for a short time.
• Speed and flakiness: Each job now queries the release manifest and may download Go (~70 MB) instead of using the runner cache. This adds roughly 10–30 s per job and adds a network dependency on go.dev. On test.yml alone that is 7 job definitions, and the test matrix runs 3 OSes. Acceptable, but worth knowing about.
• Release workflow: release.yml now builds release artifacts with the latest patch. This is desirable, because shipped binaries and the WASM build pick up stdlib fixes.

Minor / optional

• The Go version string '1.26' is repeated about 16 times. Using go-version-file: go.mod would remove the duplication. With check-latest, it resolves the latest patch matching 1.26.1 or later. The caveat is that go.mod's go 1.26.1 line would then be treated as a minimum, not a minor-version pin, so I'd consider it only if you want to cut the repetition. Not required for this PR.
• security.yml still carries the comment # Match project requirements in go.mod. It remains accurate, so no change is needed.
• test.yml job build (line 14) and job test (line 38) use different matrix keys (go-version vs go). That is pre-existing and unrelated.

Earlier open items (from the previous review, still applicable)

1. Title/description scope: The PR now covers four things: the Scorecard bump, the Trivy CVE and Go dependency fixes, the Claude review model pin, and the check-latest change. The title and body still mention only Scorecard. Please update them so git log and a revert make sense. Listing the CVE/GO IDs (GO-2026-6611, -6612, -6613, -6617 plus the Trivy ones) in the description would help auditing.
2. Claude model ID: Please confirm claude-sonnet-5-5 is accepted by your claude-code-action version. The earlier run on 27 Sep errored. The latest review run completed, which suggests it works.
3. Optional: Pin ossf/scorecard-action by commit SHA for the Scorecard "Pinned-Dependencies" check.

Security

• Positive: this closes the gap where CI and release builds could use a Go toolchain with known net/http vulnerabilities.
• No new permissions or secrets are introduced.

Testing

• No Go source changes, so there are no new tests to add. I did not run the workflows locally. The validation is the CI run: check that security.yml (govulncheck) now passes, and that test:race is green on all three OSes.

Verdict

The change is correct and safe. Update the PR title and description to reflect the full scope, confirm the CI checks are green, then merge.

--- | Branch: ci/scorecard-action-v2.4.4