From 464eaa699a30ada7756f1111ae7ae7dcfe914465 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adri=C3=A1n=20Garc=C3=ADa=20Casado?= Date: Sat, 15 Aug 2026 17:15:13 +0200 Subject: [PATCH] ci: fallback to GITHUB_TOKEN in scorecard analysis to prevent 401 Bad credentials --- .github/workflows/scorecards-analysis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml index 2c437adc6b..01826c96dc 100644 --- a/.github/workflows/scorecards-analysis.yml +++ b/.github/workflows/scorecards-analysis.yml @@ -61,7 +61,7 @@ jobs: results_format: sarif # Read-only PAT token. To create it, # follow the steps in https://github.com/ossf/scorecard-action#pat-token-creation. - repo_token: ${{ secrets.SCORECARD_READ_TOKEN }} + repo_token: ${{ secrets.SCORECARD_READ_TOKEN || secrets.GITHUB_TOKEN }} # Publish the results to enable scorecard badges. For more details, see # https://github.com/ossf/scorecard-action#publishing-results. # For private repositories, `publish_results` will automatically be set to `false`,