Update URL for OpenSSF docker image - #18

@loganaden Thank you for the PR. Validation found a couple of minor things that need to be fixed, then this can be merged. Could you please update with the following changes and force-push the commit to your PR branch?

• Linting: please change the commit message to "Update URL for OpenSSF docker image" (the CI workflow has rules for max string length, capitalization)
• URL in scorecard.yml: Please change URLs to ghcr.io/ossf/scorecard:v5.4.0 as there is no "stable" tag in the container repo. Diff will look similar to the following.

@@ -22,12 +22,12 @@ jobs:

       - name: Pull Docker image
         run: >
-          docker pull ghcr.io/ossf/scorecard:stable
+          docker pull ghcr.io/ossf/scorecard:v5.4.0

       - name: Perform required checks
         run: >
           docker run --rm -v $(pwd):/tmp/work -w /tmp/work
-          ghcr.io/ossf/scorecard:stable
+          ghcr.io/ossf/scorecard:v5.4.0
           --checks=Token-Permissions,Dangerous-Workflow,Binary-Artifacts
           --show-details
           --verbosity warn
@@ -37,7 +37,7 @@ jobs:
       - name: Generate full report
         run: >
           docker run --rm -v $(pwd):/tmp/work -w /tmp/work
-          ghcr.io/ossf/scorecard:stable
+          ghcr.io/ossf/scorecard:v5.4.0
           --local /tmp/work/source
           --format json
           > scorecard.json

Will do @jonrecker

@loganaden Thanks for the changes. The updated URL looks fine. To pass CI, could you please squash both commits into a single commit and update the actual git commit message to "Update URL for OpenSSF docker image"

You can do interactive rebase and "pick" the first commit then "squash" the second, and update the commit message.

git rebase -i HEAD~2

Or alternatively something like

git reset --soft HEAD~2   # combine last two commits
git commit . --amend      # update the commit message for the new combined commit

Then force push to your branch when it looks okay (git push -f)

If you would like to run the pre-commit checks including lint locally, you can do the following. (Set up in a virtual env or Docker container if you don't want to install the hooks in your shell). This will confirm that commit message formatting, etc. will pass CI checks.

apt install pre-commit
cd libvpl-tools/script
pre-commit run --hook-stage manual gitlint-ci
pre-commit run --all-files

@loganaden Thank you for the update. Could you please rebase your branch onto latest main from this repo? It looks like your commit pulled in changes which have already been merged to main in this commit. github should handle this automatically, but this will avoid any conflcts.

Also, after you rebase but before force-pushing the commit, please update the commit message (git commit . --amend) to start with a capital letter ("Update") to avoid a minor lint failure. Thank you.

Check commit-msg
gitlint..................................................................Failed
- hook id: gitlint-ci
- exit code: 1

1: UL3 Title does not start with a capital letter: "update openssf scorecard link"