workflows: degrade to standard token if no PAT
@@ -30,13 +30,13 @@ jobs:
persist-credentials: false
- name: "Run analysis"
- uses: ossf/scorecard-action@main
+ uses: ossf/scorecard-action@b614d455ee90608b5e36e3299cd50d457eb37d5f
with:
results_file: results.sarif
results_format: sarif
# Read-only PAT token. To create it,
# follow the steps in https://github.com/ossf/scorecard-action#pat-token-creation.
- repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}
+ repo_token: ${{ secrets.SCORECARD_READ_TOKEN || github.token }}
# Publish the results for public repositories to enable scorecard badges. For more details, see
# https://github.com/ossf/scorecard-action#publishing-results.
# For private repositories, `publish_results` will automatically be set to `false`, regardless
