chore(deps): update github-actions

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	minor	v3.6.0 -> v3.7.0
github/codeql-action	action	minor	v2.3.6 -> v2.20.4
ossf/scorecard-action	action	minor	v2.1.3 -> v2.2.0

---

⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.

---

Release Notes

actions/setup-node (actions/setup-node)

v3.7.0

Compare Source

What's Changed

In scope of this release we added a logic to save an additional cache path for yarn 3 (related pull request and feature request). Moreover, we added functionality to use all the sub directories derived from cache-dependency-path input and add detect all dependencies directories to cache (related pull request and feature request).

Besides, we made such changes as:

• Replace workflow badge with new badge by @​jongwooo in https://github.com/actions/setup-node/pull/653
• Fix a minor typo by @​phanan in https://github.com/actions/setup-node/pull/662
• docs: fix typo in advanced-usage.md by @​remarkablemark in https://github.com/actions/setup-node/pull/697
• bugfix: Don't attempt to use Windows fallbacks on non-Windows OSes by @​domdomegg in https://github.com/actions/setup-node/pull/718
• Update to node 18.x by @​feelepxyz in https://github.com/actions/setup-node/pull/751
• Remove implicit dependencies by @​nikolai-laevskii in https://github.com/actions/setup-node/pull/758
• Fix description about ensuring workflow access to private package by @​x86chi in https://github.com/actions/setup-node/pull/704

New Contributors

• @​jongwooo made their first contribution in https://github.com/actions/setup-node/pull/653
• @​phanan made their first contribution in https://github.com/actions/setup-node/pull/662
• @​remarkablemark made their first contribution in https://github.com/actions/setup-node/pull/697
• @​domdomegg made their first contribution in https://github.com/actions/setup-node/pull/718
• @​feelepxyz made their first contribution in https://github.com/actions/setup-node/pull/751
• @​nikolai-laevskii made their first contribution in https://github.com/actions/setup-node/pull/758
• @​x86chi made their first contribution in https://github.com/actions/setup-node/pull/704

Full Changelog: actions/setup-node@v3...v3.7.0

github/codeql-action (github/codeql-action)

v2.20.4

Compare Source

v2.20.3

Compare Source

v2.20.2

Compare Source

v2.20.1

Compare Source

v2.20.0

Compare Source

ossf/scorecard-action (ossf/scorecard-action)

v2.2.0

Compare Source

What's Changed

• 🌱 Bump github.com/ossf/scorecard/v4 from v4.10.5 to v4.11.0 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1192

Scorecard Result Viewer

Thanks to contributions from @​cynthia-sg and @​tegioz at CLOMonitor, there is a new Scorecard Result visualization page at https://securityscorecards.dev/viewer/?uri=<project-url>.

• https://github.com/ossf/scorecard-webapp/pull/406
• https://github.com/ossf/scorecard-webapp/pull/422

As an example, you can see our own score visualized here
Checkout our README to learn how to link your README badge to the new visualization page.

Publishing Results

This release contains two fixes which will improve the user experience when publish_results is true

• Runs that fail our workflow restrictions will fail with a 400 response indicating the problem, instead of a vague 500 status. (https://github.com/ossf/scorecard-action/pull/1156, resolved https://github.com/ossf/scorecard-action/issues/1150)
• Scorecard action will retry when signing results and submitting them to our web API. This should help with flakiness from connection failures. (https://github.com/ossf/scorecard-action/pull/1191)

Docs

• 📖 Update README to accept fine-grained tokens by @​pnacht in https://github.com/ossf/scorecard-action/pull/1175
• 📖 Update installation instructions to match current GitHub UI by @​joycebrum in https://github.com/ossf/scorecard-action/pull/1153
• 📖 Document the GitHub action workflow restrictions when publishing results. by @​spencerschrock in

New Contributors

• @​bobcallaway made their first contribution in https://github.com/ossf/scorecard-action/pull/1140
• @​pnacht made their first contribution in https://github.com/ossf/scorecard-action/pull/1175

Full Changelog: ossf/scorecard-action@v2.1.3...v2.2.0

---

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.