Bad credentials using ossf/scorecard-action@3e15ea8318eee9b333819ec77a36aca8d39df13e

[dthaler]

Most of our runs complete successfully but we see sporadic failures with:

Failed to get repository information from GitHub, response 401: Bad credentials
{
"message": "Bad credentials",
"documentation_url": "https://docs.github.com/rest"
}

If our repo were misconfigured, I would expect it to fail all the time, but failures only started showing up sporadically after upgrading to the latest scorecard action.

Example failures:
https://github.com/microsoft/ebpf-for-windows/runs/6716403783?check_suite_focus=true
https://github.com/microsoft/ebpf-for-windows/runs/6716319349?check_suite_focus=true
https://github.com/microsoft/ebpf-for-windows/runs/6701969344?check_suite_focus=true

Interspersed with successes:
https://github.com/microsoft/ebpf-for-windows/runs/6716299801?check_suite_focus=true
https://github.com/microsoft/ebpf-for-windows/runs/6715903529?check_suite_focus=true
https://github.com/microsoft/ebpf-for-windows/runs/6714825453?check_suite_focus=true

[dthaler]

Other repos are hitting this same issue:
https://github.com/microsoft/msquic/runs/6739317464?check_suite_focus=true

[azeemshaikh38]

One common thing I see among the failed runs is that they seemed to be triggered on pull_request event. Wonder if the trigger could be the cause here? @laurentsimon fyi.

@dthaler note that support for pull_request trigger is experimental only - https://github.com/ossf/scorecard-action#scorecards-github-action.

[laurentsimon]

thanks for the report @dthaler. PRs are not officially supported, but I've sent this #335 which I think should fix the issue.

I have managed to reproduce the problem. The token is available in PRs which use a local branch (dependabot PRs use local branches), but is not available for PRs fr remote repo/branches: these PRs are the one that should fail.

[laurentsimon]

re-opening temporarily. @dthaler do you want to test at the current commit @ce330fde6b1a5c9c75b417e7efc510b822a35564? I would like to cut a patch release for this, but would love to have you test it/verify it first.

[dthaler]

Manually tweaked the microsoft/ebpf-for-windows#1207 PR and the tests passed. Not sure that's a guarantee but it is a positive sign. Thanks.

[laurentsimon]

Let's cut a release and see then. Thanks!