From be92a195abb394e7cd4a0667fedb48fb1e10ca4d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 30 Jul 2026 15:42:03 +0000 Subject: [PATCH 1/2] Initial plan From d05887f9bcfdae6c2a29ca277755bf08f8fc8c20 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 30 Jul 2026 15:44:49 +0000 Subject: [PATCH 2/2] Fix Scorecards analysis: replace expired SCORECARD_READ_TOKEN with GITHUB_TOKEN The Scorecards job was failing with "401 Bad credentials" because the SCORECARD_READ_TOKEN secret was expired/invalid. For public repositories, GITHUB_TOKEN is the recommended approach - it's automatically provided, never expires, and has the necessary read permissions. Signed-off-by: Alan Jowett --- .github/workflows/scorecards-analysis.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml index 2c437adc6b..ea5ac4de5e 100644 --- a/.github/workflows/scorecards-analysis.yml +++ b/.github/workflows/scorecards-analysis.yml @@ -59,9 +59,8 @@ jobs: with: results_file: results.sarif results_format: sarif - # Read-only PAT token. To create it, - # follow the steps in https://github.com/ossf/scorecard-action#pat-token-creation. - repo_token: ${{ secrets.SCORECARD_READ_TOKEN }} + # Use GITHUB_TOKEN for public repositories (automatically provided, never expires). + repo_token: ${{ secrets.GITHUB_TOKEN }} # Publish the results to enable scorecard badges. For more details, see # https://github.com/ossf/scorecard-action#publishing-results. # For private repositories, `publish_results` will automatically be set to `false`,