github/krkn
1
0
Fork 0
mirror of https://github.com/krkn-chaos/krkn.git synced 2026-08-25 09:27:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: pass fine-grained PAT to Scorecard for branch protection check (#1365)

Browse Source 
GITHUB_TOKEN cannot read classic branch protection rules regardless of
workflow permissions. Pass a fine-grained PAT (SCORECARD_TOKEN secret)
with Administration:read so the Branch-Protection check can run without
the 'internal error: some github tokens can't read classic branch
protection rules' error.

Ref: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md

Signed-off-by: Paige Patton <prubenda@redhat.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Paige Patton
2026-05-28 15:56:14 -04:00
committed by GitHub
co-authored by Claude Sonnet 4.6
parent 3eda9f9afa
commit 9989fe9b21
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/scorecard-analysis.yml
+5
View File
@@ -41,6 +41,11 @@ jobs:
# extract the results instead of relying on our own infrastructure to run scans.
# And it's free for you!
publish_results: true
# Fine-grained PAT with Administration:read is required so Scorecard can read
# classic branch protection rules. GITHUB_TOKEN cannot access these regardless
# of workflow permissions. See:
# https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
repo_token: ${{ secrets.SCORECARD_TOKEN }}
# Upload the results as artifacts (optional). Commenting out will disable
# uploads of run results in SARIF format to the repository Actions tab.