Bump scorecard-action to 2.5.0 + revert local workaround (#457)

* Bump scorecard-action to 2.5.0

* Revert "Filter Scorecard false positives for same-repository actions (#367)"

This reverts commit 6ac006a.

Author: Kielek

.github/workflows/scorecard.yml

@@ -67,7 +67,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+      - uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -119,26 +119,8 @@ jobs:
           # The rule definitions stay in place so that code scanning closes the
           # alerts already raised for them rather than leaving them stale.
           jq --arg included "$INCLUDED_CHECKS" '
-            # Scorecard misclassifies GitHub self-repository references as unpinned
-            # third-party dependencies: https://github.com/ossf/scorecard/issues/5232
-            # Remove this filter after that fix ships in the Scorecard version used here:
-            # https://github.com/open-telemetry/shared-workflows/issues/366
-            def self_repository_reference:
-              ((.ruleId // "") == "PinnedDependenciesID")
-              and any(
-                .locations[]?;
-                ((.physicalLocation.region.snippet.text // "") | any(split("\n")[]; test("^\\s*\\$/")))
-              );
             ($included | split("\n") | map(select(length > 0))) as $keep
-            | .runs |= map(
-                .results = (
-                  (.results // [])
-                  | map(select(
-                      ((.ruleId // "") | IN($keep[]))
-                      and (self_repository_reference | not)
-                    ))
-                )
-              )
+            | .runs |= map(.results = ((.results // []) | map(select((.ruleId // "") | IN($keep[])))))
           ' results.sarif > filtered.sarif
           echo "kept $(jq '[.runs[] | (.results // [])[]] | length' filtered.sarif) of $(jq '[.runs[] | (.results // [])[]] | length' results.sarif) results"
 

scorecard/README.md

@@ -54,10 +54,4 @@ Only these checks are uploaded to code scanning:
 - `PinnedDependenciesID`
 - `TokenPermissionsID`
 
-`PinnedDependenciesID` findings for
-[GitHub's `$/` same-repository syntax](https://github.blog/changelog/2026-07-30-reference-same-repository-actions-with-self-repository-syntax/)
-are omitted from the code scanning upload because Scorecard currently
-[misclassifies them as unpinned third-party dependencies](https://github.com/ossf/scorecard/issues/5232).
-Other pinned-dependency findings are still uploaded.
-
 By default, the full result is still published, so the badge and the public `api.scorecard.dev` entry are unaffected. Runs with `skip-publication: true` do not update the badge or public entry.