gavindiaz/wickra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci(scorecard): pass a read-only PAT for the Branch-Protection check (#168)

Browse Source 
Pass a read-only fine-grained PAT (SCORECARD_TOKEN) as repo_token so the OpenSSF Scorecard Branch-Protection check can read classic branch-protection rules instead of failing with an internal error.
This commit is contained in:
kingchenc
2026-06-03 22:51:28 +02:00
committed by GitHub
parent 404bcb040c
commit 05d2e5dc61
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/scorecard.yml
+7
View File
@@ -33,6 +33,13 @@ jobs:
with: with:
results_file: results.sarif results_file: results.sarif
results_format: sarif results_format: sarif
# The default GITHUB_TOKEN cannot read classic branch-protection
# rules, so the Branch-Protection check fails with an internal error
# and scores -1. A read-only fine-grained PAT (Administration: read,
# Contents: read, Metadata: read) supplied as SCORECARD_TOKEN lets the
# check read the protection settings. See
# https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
repo_token: ${{ secrets.SCORECARD_TOKEN }}
# Publish to the public OpenSSF endpoint that backs the README badge. # Publish to the public OpenSSF endpoint that backs the README badge.
publish_results: true publish_results: true