From 828eebac63c55c14a25daa856de737082fcf9e90 Mon Sep 17 00:00:00 2001 From: laurentsimon <64505099+laurentsimon@users.noreply.github.com> Date: Tue, 26 Apr 2022 12:18:32 -0700 Subject: [PATCH 1/4] Update doc with PAT for private repos --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index e80f6568..d80e296a 100644 --- a/README.md +++ b/README.md @@ -45,7 +45,7 @@ Optional Authentication: Create a Personal Access Token (PAT) for authentication - Note: `Read-only token for OSSF Scorecard Action - myorg/myrepo` (Note: replace `myorg/myrepo` with the names of your organization and repository so you can keep track of your tokens.) - Expiration: `No expiration` - Scopes: - * `repo > public_repo` Required to read [Branch-Protection](https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection) settings. + * `repo > public_repo` Required to read [Branch-Protection](https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection) settings. Warning: for private repositories, you need scope `repo`. * `admin:org > read:org` Optional: not used in current implementation. * `admin:repo_hook > read:repo_hook` Optional: needed for the experimental [Webhook](https://github.com/ossf/scorecard/blob/main/docs/checks.md#webhooks) check. * `write:discussion > read:discussion` Optional: not used in current implementation. @@ -101,6 +101,8 @@ To verify that the Action is running successfully, click the repository's Action ### Troubleshooting If the run has failed, the most likely reason is an authentication failure. Confirm that the Personal Access Token is saved as an encrypted secret within the same repository (see [Authentication](#authentication)). +If you install Scorecard on a private repository with a PAT token, provide the `repo:` scope. (The `repo > public_repo` scope only provides access to public repositories.) + If you install Scorecard on a repository owned by an organization that uses [SAML SSO](https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/about-authentication-with-saml-single-sign-on) or if you see `403 Resource protected by organization SAML enforcement` in the logs, be sure to [enable SSO](https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on) for your PAT token (see [Authentication](#authentication)). If the PAT is saved as an encrypted secret and the run is still failing, confirm that you have not made any changes to the workflow yaml file that affected the syntax. Review the [workflow example](#workflow-example) and reset to the default values if necessary. From 11536a64e1878e6461de27fe40c010124758c837 Mon Sep 17 00:00:00 2001 From: laurentsimon <64505099+laurentsimon@users.noreply.github.com> Date: Tue, 26 Apr 2022 12:19:48 -0700 Subject: [PATCH 2/4] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index d80e296a..75bc3956 100644 --- a/README.md +++ b/README.md @@ -101,7 +101,7 @@ To verify that the Action is running successfully, click the repository's Action ### Troubleshooting If the run has failed, the most likely reason is an authentication failure. Confirm that the Personal Access Token is saved as an encrypted secret within the same repository (see [Authentication](#authentication)). -If you install Scorecard on a private repository with a PAT token, provide the `repo:` scope. (The `repo > public_repo` scope only provides access to public repositories.) +If you install Scorecard on a private repository with a PAT token, provide the `repo` scope. (The `repo > public_repo` scope only provides access to public repositories.) If you install Scorecard on a repository owned by an organization that uses [SAML SSO](https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/about-authentication-with-saml-single-sign-on) or if you see `403 Resource protected by organization SAML enforcement` in the logs, be sure to [enable SSO](https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on) for your PAT token (see [Authentication](#authentication)). From b07fcd3d9d892532a7ded8b53c1fc4ecdd663ecd Mon Sep 17 00:00:00 2001 From: laurentsimon <64505099+laurentsimon@users.noreply.github.com> Date: Tue, 26 Apr 2022 12:20:56 -0700 Subject: [PATCH 3/4] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 75bc3956..9e71abb6 100644 --- a/README.md +++ b/README.md @@ -45,7 +45,7 @@ Optional Authentication: Create a Personal Access Token (PAT) for authentication - Note: `Read-only token for OSSF Scorecard Action - myorg/myrepo` (Note: replace `myorg/myrepo` with the names of your organization and repository so you can keep track of your tokens.) - Expiration: `No expiration` - Scopes: - * `repo > public_repo` Required to read [Branch-Protection](https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection) settings. Warning: for private repositories, you need scope `repo`. + * `repo > public_repo` Required to read [Branch-Protection](https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection) settings. **Warning**: for private repositories, you need scope `repo`. * `admin:org > read:org` Optional: not used in current implementation. * `admin:repo_hook > read:repo_hook` Optional: needed for the experimental [Webhook](https://github.com/ossf/scorecard/blob/main/docs/checks.md#webhooks) check. * `write:discussion > read:discussion` Optional: not used in current implementation. From cac1413c7ef7d8850b42dc9face9e1e74bb7655f Mon Sep 17 00:00:00 2001 From: laurentsimon <64505099+laurentsimon@users.noreply.github.com> Date: Tue, 26 Apr 2022 13:16:28 -0700 Subject: [PATCH 4/4] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 9e71abb6..905406eb 100644 --- a/README.md +++ b/README.md @@ -45,7 +45,7 @@ Optional Authentication: Create a Personal Access Token (PAT) for authentication - Note: `Read-only token for OSSF Scorecard Action - myorg/myrepo` (Note: replace `myorg/myrepo` with the names of your organization and repository so you can keep track of your tokens.) - Expiration: `No expiration` - Scopes: - * `repo > public_repo` Required to read [Branch-Protection](https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection) settings. **Warning**: for private repositories, you need scope `repo`. + * `repo > public_repo` Required to read [Branch-Protection](https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection) settings. **Note**: for private repositories, you need scope `repo`. * `admin:org > read:org` Optional: not used in current implementation. * `admin:repo_hook > read:repo_hook` Optional: needed for the experimental [Webhook](https://github.com/ossf/scorecard/blob/main/docs/checks.md#webhooks) check. * `write:discussion > read:discussion` Optional: not used in current implementation.