From afa86ca4d47c188706fab41078c4517975842a94 Mon Sep 17 00:00:00 2001 From: ErenAri Date: Mon, 15 Jun 2026 01:43:42 +0300 Subject: [PATCH] Pass SCORECARD_TOKEN as repo_token so Scorecard can read branch protection The default GITHUB_TOKEN can't read branch-protection rules, leaving the Branch-Protection check at -1 (internal error). Wire the fine-grained PAT (Administration: read) stored in the SCORECARD_TOKEN secret. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/scorecard.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 918cff8f..3b86974d 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -43,6 +43,9 @@ jobs: with: results_file: results.sarif results_format: sarif + # Fine-grained PAT (Administration: read) so Scorecard can read + # branch-protection rules, which the default GITHUB_TOKEN cannot. + repo_token: ${{ secrets.SCORECARD_TOKEN }} publish_results: true - name: Upload artifact