Update to hash

[naveensrinivasan]

scorecard-action/starter-workflows/code-scanning/scorecards.yml

Line 28 in 25e5ca0

uses: ossf/scorecard-action@feat/rempol

[naveensrinivasan]

@laurentsimon

[laurentsimon]

good point. We're not using the starter-workflow in this repo. I created them to keep a copy from https://github.com/actions/starter-workflows/blob/main/code-scanning/scorecards.yml. I now realize that may be a pain to keep them in sync all the time. Shall we remove them from our repo? wdut?

[naveensrinivasan]

I think we should remove it.

[laurentsimon]

Can you send a PR for that? I'll LGTM. I'd like to keep track of how to do releases. There's an issue I created with steps to follow that indicate where to update the starter workflows. How about creating a RELEASE.md with those steps?

[naveensrinivasan]

We shouldn't remove this. Teams are directly using this action https://github.com/google/licensecheck/blob/db1987b6bdd30a6777a02509214b17063deff3c8/.github/workflows/scorecards-analysis.yml#L30

[laurentsimon]

what I mean is that the local file scorecard-action/starter-workflows/code-scanning/scorecards.yml is just a copy of the real file hosted at https://github.com/actions/starter-workflows/blob/main/code-scanning/scorecards.yml

The local copy can be removed without impacting any team, as it's not used for anything at all.

[justaugustus]

I've done some cleanup of this in #301.
Let's continue discussion in #315.