Bump ossf/scorecard-action to v2.4.4

[dkwon17]

Description of Changes

Summarize the changes you made as part of this pull request.
Bumps ossf/scorecard-action to v2.4.4 which should fix the image pull problem in https://github.com/devfile/api/actions/runs/37448858362/job/112220195277?pr=1791

Related Issue(s)

Link the GitHub/GitLab/JIRA issues that are related to this PR.

Acceptance Criteria

Testing and documentation do not need to be complete in order for this PR to be approved. However, tracking issues must be opened for missing testing/documentation.

New testing and documentation issues can be opened under devfile/api/issues.

You can check the respective criteria below if either of the following is true:

• There is a separate tracking issue opened and that issue is linked in this PR.
• Testing/documentation updates are contained within this PR.

If criteria is left unchecked please provide an explanation why.

• Unit/Functional tests

• QE Integration test

• Documentation

• Client Impact

Tests Performed

Explain what tests you personally ran to ensure the changes are functioning as expected.

How To Test

Instructions for the reviewer on how to test your changes.

Notes To Reviewer

Any notes you would like to include for the reviewer.

Summary by CodeRabbit

• Chores
  • Updated the Scorecard analysis workflow to use a newer version of its analysis tool.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9f9ef7a0-49e6-4136-97c4-a6e8fe30ed84

📥 Commits

Reviewing files that changed from the base of the PR and between 801f7ee and 8764690.

📒 Files selected for processing (1)

• .github/workflows/scorecard.yml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

📝 Walkthrough

Walkthrough

The Scorecard workflow now pins ossf/scorecard-action to the commit for v2.4.4, replacing the pin for v2.1.2.

Changes

Scorecard workflow

Layer / File(s)	Summary
Update Scorecard action pin .github/workflows/scorecard.yml	The workflow pin changes from the v2.1.2 commit to the v2.4.4 commit.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 87646

The Scorecard workflow now uses the v2.4.4 action revision with compatible configuration. No actionable merge-blocking risk is evident from this change.

Architecture Summary

Architecture risk: 🔵 Low · up to 87646

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/scorecard.yml: The Scorecard action pin changes from commit e38b1902ae4f44df626f11ba0734b14fb91f8f86 (v2.1.2) to 2d1146689b8cda280b9bc96326124645441f03bc (v2.4.4).

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the change: updating ossf/scorecard-action to v2.4.4.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[michael-valdron]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dkwon17, michael-valdron, rohanKanojia

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment