[bug] Scorecard action not reporting binary artifacts in the repo

[godofredoc]

flutter/packages contain a binary artifact https://github.com/flutter/packages/blob/main/packages/rfw/example/wasm/logic/calculator.wasm but scorecard action is not reporting it(https://deps.dev/project/github/flutter%2Fpackages).

It seems like the current version is from the end of 2020 is there a new release scheduled? is this caused by the action not using the latest version of scorecard?

[godofredoc]

\cc @diogoteles08

[diogoteles08]

Hi!

@gabibguti helped me on the analysis, and we could verify that the file is being reported by Scorecard v4.10.4 but it's not by Scorecard v4.10.2 , so that should be it.

Is there an easy way to verify what Scorecard version is used by the latest scorecard-action version?

[spencerschrock]

Is there an easy way to verify what Scorecard version is used by the latest scorecard-action version?

Any artifacts will have the scorecard version used in them:
e.g. https://github.com/ossf/scorecard/actions/runs/4556801547

The release notes usually include the scorecard version in the changelog. Or you can look at the go.mod file at the tag in question: https://github.com/ossf/scorecard-action/blob/v2.1.3/go.mod

v2.1.3 has been released which has this fix. Feel free to re-open if you continue to observe the behavior after updating.

[godofredoc]

Thanks @spencerschrock for the new release. Dependabot already started rolling the new version to the flutter repositories.