🐛 Split ko matcher so either setup-ko spelling is detected

checks/fileparser/github_workflow.go

@@ -573,10 +573,20 @@ func IsPackagingWorkflow(workflow *actionlint.Workflow, fp string) (JobMatchResu
 		},
 		{
 			// Ko container action. https://github.com/google/ko
+			// The action was renamed from imjasonh/setup-ko to ko-build/setup-ko,
+			// so both spellings need their own single-step matcher: JobMatcher
+			// requires every listed step to match, and a workflow uses only one
+			// of them. See https://github.com/ossf/scorecard/issues/5133.
 			Steps: []*JobMatcherStep{
 				{
 					Uses: "imjasonh/setup-ko",
 				},
+			},
+			LogText: "candidate container publishing workflow using ko",
+		},
+		{
+			// Ko container action. https://github.com/google/ko
+			Steps: []*JobMatcherStep{
 				{
 					Uses: "ko-build/setup-ko",
 				},

checks/fileparser/github_workflow_test.go

@@ -984,6 +984,16 @@ func TestIsPackagingWorkflow(t *testing.T) {
 			filename: "../testdata/.github/workflows/github-workflow-packaging-go.yaml",
 			expected: true,
 		},
+		{
+			name:     "ko publish (renamed action)",
+			filename: "../testdata/.github/workflows/github-workflow-packaging-ko-renamed-action.yaml",
+			expected: true,
+		},
+		{
+			name:     "ko publish (legacy action)",
+			filename: "../testdata/.github/workflows/github-workflow-packaging-ko-legacy-action.yaml",
+			expected: true,
+		},
 		{
 			name:     "cargo publish",
 			filename: "../testdata/.github/workflows/github-workflow-packaging-cargo.yaml",

checks/testdata/.github/workflows/github-workflow-packaging-ko-legacy-action.yaml

@@ -0,0 +1,27 @@
+# Copyright 2026 OpenSSF Scorecard Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: ko publish (legacy action)
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: imjasonh/setup-ko@v0.6
+      - run: ko build ./

checks/testdata/.github/workflows/github-workflow-packaging-ko-renamed-action.yaml

@@ -0,0 +1,27 @@
+# Copyright 2026 OpenSSF Scorecard Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: ko publish
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: ko-build/setup-ko@v0.6
+      - run: ko build ./