Fix Scorecard authentication with GITHUB_TOKEN - #15
Merged
Liang-Chun Tsai (ltsai-dev) merged 6 commits intoAug 17, 2026
Merged
Conversation
added 6 commits
August 17, 2026 10:02
Use the workflow GITHUB_TOKEN for private repository scans and add the documented read permissions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 22274a22-19ba-4b95-be2e-cbd4ea21f65e
Scorecard only supports execution from the default branch, so keep push scans scoped to main. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 22274a22-19ba-4b95-be2e-cbd4ea21f65e
Run the v2.4.4 container against main with the workflow-issued GITHUB_TOKEN without changing the default branch. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 22274a22-19ba-4b95-be2e-cbd4ea21f65e
Mount the Actions event payload into the container and target the default branch for the isolated token test. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 22274a22-19ba-4b95-be2e-cbd4ea21f65e
Allow the isolated Scorecard check to survive temporary GitHub API 503 responses while still failing persistent authentication or analysis errors. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 22274a22-19ba-4b95-be2e-cbd4ea21f65e
The workflow-issued GITHUB_TOKEN completed the v2.4.4 analysis and produced SARIF, so remove the branch-only validation harness. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 22274a22-19ba-4b95-be2e-cbd4ea21f65e
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The weekly OpenSSF Scorecard scan stopped working because its personal access token violated the enterprise expiration policy and then expired. This switches the scan to GitHub Actions' automatic short-lived token, eliminating manual token rotation.
Changes
SCORECARD_TOKENinput so Scorecard uses the workflow-issuedGITHUB_TOKEN.ossf/scorecard-actionfrom v2.4.3 to v2.4.4.Test plan
Ran the exact Scorecard v2.4.4 container in GitHub Actions with the workflow-issued token against
main. The analysis completed successfully and produced non-empty SARIF: https://github.com/microsoft/thinkingbox/actions/runs/32049075473The first attempts coincided with GitHub's August 17 API/Actions outage and returned GraphQL 503 responses; the unchanged validation passed after service recovery.
Related issues
N/A