Update URL for OpenSSF docker image

[loganaden]

sign-off-by: Avishai Poorun
sign-off-by: Zahra Sumun

[jonrecker]

@loganaden Thank you for the PR. Validation found a couple of minor things that need to be fixed, then this can be merged. Could you please update with the following changes and force-push the commit to your PR branch?

• Linting: please change the commit message to "Update URL for OpenSSF docker image" (the CI workflow has rules for max string length, capitalization)
• URL in scorecard.yml: Please change URLs to ghcr.io/ossf/scorecard:v5.4.0 as there is no "stable" tag in the container repo. Diff will look similar to the following.

@@ -22,12 +22,12 @@ jobs:

       - name: Pull Docker image
         run: >
-          docker pull ghcr.io/ossf/scorecard:stable
+          docker pull ghcr.io/ossf/scorecard:v5.4.0

       - name: Perform required checks
         run: >
           docker run --rm -v $(pwd):/tmp/work -w /tmp/work
-          ghcr.io/ossf/scorecard:stable
+          ghcr.io/ossf/scorecard:v5.4.0
           --checks=Token-Permissions,Dangerous-Workflow,Binary-Artifacts
           --show-details
           --verbosity warn
@@ -37,7 +37,7 @@ jobs:
       - name: Generate full report
         run: >
           docker run --rm -v $(pwd):/tmp/work -w /tmp/work
-          ghcr.io/ossf/scorecard:stable
+          ghcr.io/ossf/scorecard:v5.4.0
           --local /tmp/work/source
           --format json
           > scorecard.json

[loganaden]

Will do @jonrecker

[jonrecker]

@loganaden Thanks for the changes. The updated URL looks fine. To pass CI, could you please squash both commits into a single commit and update the actual git commit message to "Update URL for OpenSSF docker image"

You can do interactive rebase and "pick" the first commit then "squash" the second, and update the commit message.

git rebase -i HEAD~2

Or alternatively something like

git reset --soft HEAD~2   # combine last two commits
git commit . --amend      # update the commit message for the new combined commit

Then force push to your branch when it looks okay (git push -f)

If you would like to run the pre-commit checks including lint locally, you can do the following. (Set up in a virtual env or Docker container if you don't want to install the hooks in your shell). This will confirm that commit message formatting, etc. will pass CI checks.

apt install pre-commit
cd libvpl-tools/script
pre-commit run --hook-stage manual gitlint-ci
pre-commit run --all-files