ci: fallback to GITHUB_TOKEN in scorecard analysis when SCORECARD_READ_TOKEN is unavailable

[adri22235]

Description

Resolves a CI failure where the Scorecards analysis workflow fails with 401 Bad credentials on push/forks if SCORECARD_READ_TOKEN is expired or unavailable:

scorecard had an error: repo unreachable: GET https://api.github.com/repos/microsoft/ebpf-for-windows: 401 Bad credentials []

This change updates the repo_token to fall back to ${{ secrets.SCORECARD_READ_TOKEN || secrets.GITHUB_TOKEN }}, ensuring that the workflow can always authenticate with the GitHub Actions default token while maintaining support for dedicated tokens when available.
Testing

    Verified syntax against .github/workflows/scorecards-analysis.yml.

    Verified required job permissions (security-events: write, id-token: write, contents: read) are already present for GITHUB_TOKEN.

[github-actions]

This pull request isn't linked to any GitHub issue. Please reference an issue with a keyword such as Fixes #123, Closes #456, etc., so the work can be tracked.

[github-actions]

This pull request isn't linked to any GitHub issue. Please reference an issue with a keyword such as Fixes #123, Closes #456, etc., so the work can be tracked.

[github-actions]

This pull request isn't linked to any GitHub issue. Please reference an issue with a keyword such as Fixes #123, Closes #456, etc., so the work can be tracked.

[Copilot]

Pull request overview

This PR updates the Scorecards GitHub Actions workflow to avoid authentication failures by falling back to the default Actions token when a dedicated Scorecards read token isn’t available, improving CI reliability for Scorecards analysis in the eBPF for Windows repo.

Changes:

• Update ossf/scorecard-action repo_token to use ${{ secrets.SCORECARD_READ_TOKEN || secrets.GITHUB_TOKEN }} as a fallback mechanism.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

This pull request isn't linked to any GitHub issue. Please reference an issue with a keyword such as Fixes #123, Closes #456, etc., so the work can be tracked.