[efegokdemir]

Summary

Pin Scorecard Action to v2.5.0 and publish the workflow results to the Scorecard API.

Motivation

The workflow currently uploads SARIF but does not publish a result through the Scorecard API. Publication requires publish_results: true and job-level id-token: write (Scorecard Action documentation).

Changes

• Update ossf/scorecard-action to fa7117db83c52d787ae5a89f350999701505d78e (v2.5.0).
• Add publish_results: true.
• Retain existing permissions, triggers and SARIF upload.

Tests performed

• Checks run below.
• actionlint .github/workflows/scorecard.yml and git diff --check passed.
• npm ci; npm test (105 passed); npm run coverage (105 passed; configured thresholds met); npm run lint; npm run typecheck; npm run build; npm run package:smoke; npm run action:check; and npm audit --omit=dev --audit-level=high (0 vulnerabilities) passed.
• npm ci printed npm 11’s install-script approval warning for esbuild; the build and Action checks passed.

Compatibility

No application runtime or package changes. Local checks ran on Node 26.10.0/npm 11.19.1; hosted Node 22/24 checks are pending.

Security and privacy

The existing job-level security-events: write, id-token: write and contents: read permissions are sufficient for publication and SARIF upload. No permissions were expanded; the workflow retains empty top-level permissions.

Shopify source/evidence

N/A.

Release impact

Repository CI workflow only. No product Action behaviour, package behaviour, documentation, package version or release workflow changes; no npm release.

Checklist

• The change is focused and the docs/examples match the implementation.
• Relevant regression tests and checks are recorded above.
• Generated distributions are up to date where required; none are needed for this workflow-only change.
• No sensitive or unreviewed third-party material was added.