Failed to run automated scorecard-action@main test-organization-ls/scorecard-action-private-repo-tests

[naveensrinivasan]

https://github.com/test-organization-ls/scorecard-action-private-repo-tests/actions/runs/2217769550

[rohankh532]

#189 (comment)

I think this is what's causing this, #200, and #199 to fail. I'm not sure which permission is missing though--but adding read-all fixes it. Is there a certain permission necessary for workflows to make API requests? @azeemshaikh38

[laurentsimon]

no permission means all permissions default to none. On a public repo it's not a problem because the repo is public. On a private repo you need to be able to read it so you must declare some read permissions.. not sure which ones exactly. read-all is fine

[azeemshaikh38]

This is a great finding @rohankh532 @laurentsimon. We need to update our GitHub partnered workflow to include these changes before rolling out Golang:

• top-level read-all permissions
• id-token: write permission
• GITHUB_TOKEN by default with a comment to use PAT if Branch-Protection is needed.

[laurentsimon]

This is a great finding @rohankh532 @laurentsimon. We need to update our GitHub partnered workflow to include these changes before rolling out Golang:

• top-level read-all permissions

already the case.

• id-token: write permission

correct.

• GITHUB_TOKEN by default with a comment to use PAT if Branch-Protection is needed.

this is in the TODO list once we've verified that everything else works. #203 is waiting for approval to merge this change in our README before making the change to starter workflow.

[laurentsimon]

I have an idea what's going on. The repo is private: we should not send the data to our backend in this case, but we seem to be doing that. During verification the backend tries to verify the workflow to validate it.. but the repo is private so it's not reachable.. and it fails.

The solution is to not send the data for private repo... we should not do that anyway... it's great that the verification does not work.. nice fallback in case we make a mistake on the client code.

[rohankh532]

@laurentsimon isn't the repo this is being run on public? https://github.com/test-organization-ls/scorecard-action-private-repo-tests

[rohankh532]

Here's what's happening on the server end.

PR ossf/scorecard-webapp#85 should fix this

[laurentsimon]

It is a private repo. Can you confirm that you cannot visit the repo?
The logs show "bad gateway", I thought. The bad gateway is likely to be because it's a private repo.

Ouch, another nil pointer: did we push the code change to k8 cluster (k8 apply -f)? The nil pointer seems like it's the same error as last week before we made the change

[laurentsimon]

got it, so have not merged it yet.