Skip to content

Commit fe94a5b

Browse files
shenxianpengshenxianpeng
authored
fix: move id-token: write to job-level for Scorecard API compliance (#455)
The OpenSSF Scorecard API rejects workflows with global write permissions when publish_results: true. Move id-token: write from the top-level permissions block to the analysis job-level permissions to comply with the action's workflow restrictions.
1 parent c724181 commit fe94a5b

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

‎.github/workflows/scorecard.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,14 @@ on:
66
workflow_dispatch:
77

88
permissions:
9-
id-token: write
109
contents: read
1110

1211
jobs:
1312
analysis:
1413
runs-on: ubuntu-24.04
14+
permissions:
15+
id-token: write
16+
contents: read
1517
steps:
1618
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
1719
with:

0 commit comments

Comments
 (0)