options: If empty, set GITHUB_AUTH_TOKEN from INPUT_REPO_TOKEN

Signed-off-by: Stephen Augustus <[email protected]>

options/options.go

@@ -69,11 +69,6 @@ type Options struct {
 	InputResultsFile    string `env:"INPUT_RESULTS_FILE"`
 	InputResultsFormat  string `env:"INPUT_RESULTS_FORMAT"`
 	InputPublishResults string `env:"INPUT_PUBLISH_RESULTS"`
-
-	// Repo tokens
-	// TODO(auth): DO NOT STORE AUTH
-	EnvGithubAuthToken string `env:"GITHUB_AUTH_TOKEN"`
-	EnvInputRepoToken  string `env:"INPUT_REPO_TOKEN"`
 }
 
 const (
@@ -132,10 +127,6 @@ func New() (*Options, error) {
 		return opts, errResultsPathEmpty
 	}
 
-	if opts.EnvGithubAuthToken == "" {
-		opts.EnvGithubAuthToken = opts.EnvInputRepoToken
-	}
-
 	if err := opts.Validate(); err != nil {
 		return opts, fmt.Errorf("validating scorecard-action options: %w", err)
 	}
@@ -158,6 +149,12 @@ func (o *Options) Initialize() error {
 	// o.EnableLicense = "1"
 	// o.EnableDangerousWorkflow = "1"
 
+	_, tokenSet := os.LookupEnv(EnvGithubAuthToken)
+	if !tokenSet {
+		inputToken := os.Getenv(EnvInputRepoToken)
+		os.Setenv(EnvGithubAuthToken, inputToken)
+	}
+
 	return o.SetRepoInfo()
 }