Sync common files from infra repository

Synchronized from bootc-dev/infra@5a09005.

Signed-off-by: bootc-dev Bot <bot@bootc.dev>

Author: bootc-dev Bot

.bootc-dev-infra-commit.txt

@@ -1 +1 @@
-e03327703622b506788369cbaef7ea5b4d61fb3d
+5a0900533a2b015c83b81e21f1ef78c6f7ad6067

.github/actions/bootc-ubuntu-setup/action.yml

@@ -67,7 +67,7 @@ runs:
       shell: bash
       run: |
         set -xeuo pipefail
-        export BCVK_VERSION=0.9.0
+        export BCVK_VERSION=0.10.0
         # see https://github.com/bootc-dev/bcvk/issues/176
         /bin/time -f '%E %C' sudo apt install -y libkrb5-dev pkg-config libvirt-dev genisoimage qemu-utils qemu-kvm virtiofsd libvirt-daemon-system python3-virt-firmware
         # Something in the stack is overriding this, but we want session right now for bcvk

.github/workflows/openssf-scorecard-gate.yml

@@ -0,0 +1,28 @@
+# Gate PRs on OpenSSF Scorecard regressions.
+#
+# See also: https://github.com/ossf/scorecard/issues/1270
+name: OpenSSF Scorecard
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  scorecard:
+    name: Scorecard
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Check for regressions
+        uses: bootc-dev/actions/openssf-scorecard@main
+        with:
+          base-sha: ${{ github.event.pull_request.base.sha }}
+          head-sha: ${{ github.event.pull_request.head.sha }}