From 05d2e5dc61d14758d1999ad7c2393a82cd6de152 Mon Sep 17 00:00:00 2001 From: kingchenc Date: Wed, 3 Jun 2026 22:51:28 +0200 Subject: [PATCH] ci(scorecard): pass a read-only PAT for the Branch-Protection check (#168) Pass a read-only fine-grained PAT (SCORECARD_TOKEN) as repo_token so the OpenSSF Scorecard Branch-Protection check can read classic branch-protection rules instead of failing with an internal error. --- .github/workflows/scorecard.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index c3f42025..65038170 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -33,6 +33,13 @@ jobs: with: results_file: results.sarif results_format: sarif + # The default GITHUB_TOKEN cannot read classic branch-protection + # rules, so the Branch-Protection check fails with an internal error + # and scores -1. A read-only fine-grained PAT (Administration: read, + # Contents: read, Metadata: read) supplied as SCORECARD_TOKEN lets the + # check read the protection settings. See + # https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md + repo_token: ${{ secrets.SCORECARD_TOKEN }} # Publish to the public OpenSSF endpoint that backs the README badge. publish_results: true