From 9989fe9b21eef7aa2094c2366eead7c2412f47d6 Mon Sep 17 00:00:00 2001 From: Paige Patton <64206430+paigerube14@users.noreply.github.com> Date: Thu, 28 May 2026 15:56:14 -0400 Subject: [PATCH] fix: pass fine-grained PAT to Scorecard for branch protection check (#1365) GITHUB_TOKEN cannot read classic branch protection rules regardless of workflow permissions. Pass a fine-grained PAT (SCORECARD_TOKEN secret) with Administration:read so the Branch-Protection check can run without the 'internal error: some github tokens can't read classic branch protection rules' error. Ref: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-off-by: Paige Patton Co-authored-by: Claude Sonnet 4.6 --- .github/workflows/scorecard-analysis.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/scorecard-analysis.yml b/.github/workflows/scorecard-analysis.yml index 7de7d7ea..1b1eb69b 100644 --- a/.github/workflows/scorecard-analysis.yml +++ b/.github/workflows/scorecard-analysis.yml @@ -41,6 +41,11 @@ jobs: # extract the results instead of relying on our own infrastructure to run scans. # And it's free for you! publish_results: true + # Fine-grained PAT with Administration:read is required so Scorecard can read + # classic branch protection rules. GITHUB_TOKEN cannot access these regardless + # of workflow permissions. See: + # https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md + repo_token: ${{ secrets.SCORECARD_TOKEN }} # Upload the results as artifacts (optional). Commenting out will disable # uploads of run results in SARIF format to the repository Actions tab.