docs: document fine-grained token scopes for ORG_SCORECARD_TOKEN#248
docs: document fine-grained token scopes for ORG_SCORECARD_TOKEN#248don-petry wants to merge 44 commits into
Conversation
|
Warning Review limit reached
More reviews will be available in 55 minutes and 23 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR updates token scope requirements for the OpenSSF Scorecard integration across two coordinated locations: the compliance audit script's error message now directs operators to verify ChangesORG_SCORECARD_TOKEN scope requirements
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the compliance audit script and documentation to clarify the requirements for the ORG_SCORECARD_TOKEN when using Fine-Grained Personal Access Tokens. The reviewer suggested including the necessary Organization-level 'Metadata: Read-only' scope in both the script's error message and the documentation to ensure repository discovery works correctly. Additionally, it was recommended to specify 'Read and write' access for Issues since the script manages them.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
This PR updates the org standards documentation and audit-script messaging to clarify required Fine-Grained PAT permissions for ORG_SCORECARD_TOKEN, intended to prevent false-positive compliance findings when reading repository settings such as delete_branch_on_merge.
Changes:
- Document Fine-Grained PAT requirements for
ORG_SCORECARD_TOKENinstandards/ci-standards.md. - Update the
gh auth statusfailure message inscripts/compliance-audit.shto reference Fine-Grained PAT permissions.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| standards/ci-standards.md | Adds documentation for the Fine-Grained PAT permissions needed by ORG_SCORECARD_TOKEN. |
| scripts/compliance-audit.sh | Adjusts authentication failure guidance to mention Fine-Grained PAT permissions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
don-petry
force-pushed
the
update-scorecard-token-docs
branch
from
593ed67 to
4c75d2a
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/compliance-audit.sh`:
- Line 1319: Update the error message string that currently says "Check that
ORG_SCORECARD_TOKEN is valid. If using a Fine-Grained token, ensure it has
'Administration: Read-only' and 'Metadata: Read-only' repository scopes." to
either enumerate all five required Fine-Grained token scopes (Administration:
Read-only; Metadata: Read-only; Contents: Read-only; Issues: Read and write;
Organization: Metadata (Read-only)) or replace the inline scope list with a
short pointer to the full documentation (e.g., "see standards/ci-standards.md
lines 964-968") so operators receive complete remediation guidance; locate and
edit the exact message literal in scripts/compliance-audit.sh that emits the
ORG_SCORECARD_TOKEN guidance.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 4167fc72-e5e4-414e-aa59-bfece5cca38b
📒 Files selected for processing (2)
scripts/compliance-audit.shstandards/ci-standards.md
|
Auto-rebase failed — merge conflict — this branch has conflicts with Please resolve the conflicts and push: |
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
don-petry
force-pushed
the
update-scorecard-token-docs
branch
from
a4ca4f8 to
4b87b36
Compare
Superseded by automated re-review at
|
Superseded by automated re-review at
|
There was a problem hiding this comment.
♻️ Duplicate comments (1)
scripts/compliance-audit.sh (1)
1697-1697:⚠️ Potential issue | 🟠 Major | ⚡ Quick winIncomplete token scope list in error message — still unresolved.
This error message only mentions 2 of the 5 required Fine-Grained token scopes documented in
standards/ci-standards.mdlines 1063-1067. Operators encountering authentication failures will not receive complete remediation guidance.Missing from the error message:
- Contents: Read-only
- Issues: Read and write
- Organization: Metadata (Read-only)
This issue was previously flagged and marked as "Addressed" but the incomplete scope list remains in the current code.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/compliance-audit.sh` at line 1697, Update the error message that warns about ORG_SCORECARD_TOKEN validity to list all five required Fine-Grained token scopes; modify the string that currently mentions "Administration: Read-only" and "Metadata: Read-only" to also include "Contents: Read-only", "Issues: Read and write", and "Organization: Metadata (Read-only)" so operators see the complete remediation guidance for ORG_SCORECARD_TOKEN.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@scripts/compliance-audit.sh`:
- Line 1697: Update the error message that warns about ORG_SCORECARD_TOKEN
validity to list all five required Fine-Grained token scopes; modify the string
that currently mentions "Administration: Read-only" and "Metadata: Read-only" to
also include "Contents: Read-only", "Issues: Read and write", and "Organization:
Metadata (Read-only)" so operators see the complete remediation guidance for
ORG_SCORECARD_TOKEN.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: ea71fe43-3547-494b-b13a-828a99622d85
📒 Files selected for processing (2)
scripts/compliance-audit.shstandards/ci-standards.md
There was a problem hiding this comment.
♻️ Duplicate comments (1)
scripts/compliance-audit.sh (1)
1697-1697:⚠️ Potential issue | 🟠 Major | ⚡ Quick winError message lists incomplete Fine-Grained token scopes.
This error message only mentions 2 of the 5 required Fine-Grained token scopes documented in
standards/ci-standards.md(lines 1059-1067). Operators who encounter this authentication failure won't receive complete remediation guidance.Missing scopes from error message:
- Contents: Read-only (repository)
- Issues: Read and write (repository)
- Organization: Metadata (Read-only) (organization scope for listing repositories)
As per the context snippet from standards/ci-standards.md, the complete list is: "Administration: Read-only, Metadata: Read-only, Contents: Read-only, and Issues: Read and write. Additionally, it requires Organization: Metadata (Read-only) to list repositories in the organization."
Additionally, this line exceeds the 100-character guideline for shell scripts.
🔧 Proposed fix (Option 1: Reference documentation)
- echo "::error::gh auth failed — GH_TOKEN is set but authentication did not succeed." \ - "Check that ORG_SCORECARD_TOKEN is valid. If using a Fine-Grained token, ensure it has 'Administration: Read-only' and 'Metadata: Read-only' repository scopes." >&2 + echo "::error::gh auth failed — GH_TOKEN is set but authentication did not succeed. " \ + "Check that ORG_SCORECARD_TOKEN is valid. If using a Fine-Grained token, verify all " \ + "required repository and organization scopes are configured per " \ + "standards/ci-standards.md#openssf-scorecard-org-scorecardyml" >&2Option 2: List all scopes inline (less maintainable)
- echo "::error::gh auth failed — GH_TOKEN is set but authentication did not succeed." \ - "Check that ORG_SCORECARD_TOKEN is valid. If using a Fine-Grained token, ensure it has 'Administration: Read-only' and 'Metadata: Read-only' repository scopes." >&2 + echo "::error::gh auth failed — GH_TOKEN is set but authentication did not succeed. " \ + "Check that ORG_SCORECARD_TOKEN is valid. If using a Fine-Grained token, ensure it has " \ + "repository scopes: 'Administration: Read-only', 'Metadata: Read-only', " \ + "'Contents: Read-only', 'Issues: Read and write'; and organization scope: " \ + "'Metadata: Read-only' (to list repositories)." >&2🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/compliance-audit.sh` at line 1697, Update the error string that currently reads "Check that ORG_SCORECARD_TOKEN is valid. If using a Fine-Grained token, ensure it has 'Administration: Read-only' and 'Metadata: Read-only' repository scopes." to list all required Fine‑Grained token scopes per standards/ci-standards.md (Administration: Read-only, Metadata: Read-only, Contents: Read-only, Issues: Read and write, and Organization: Metadata (Read-only)) and reflow/wrap the message to respect the 100‑character line limit in the shell script; locate and edit the exact echoed/error message string in scripts/compliance-audit.sh to make these replacements.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@scripts/compliance-audit.sh`:
- Line 1697: Update the error string that currently reads "Check that
ORG_SCORECARD_TOKEN is valid. If using a Fine-Grained token, ensure it has
'Administration: Read-only' and 'Metadata: Read-only' repository scopes." to
list all required Fine‑Grained token scopes per standards/ci-standards.md
(Administration: Read-only, Metadata: Read-only, Contents: Read-only, Issues:
Read and write, and Organization: Metadata (Read-only)) and reflow/wrap the
message to respect the 100‑character line limit in the shell script; locate and
edit the exact echoed/error message string in scripts/compliance-audit.sh to
make these replacements.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: abee9d64-1da9-45bc-930a-84707797a74c
📒 Files selected for processing (1)
scripts/compliance-audit.sh
Dev-Lead — fix-bot-comment (applied)Changes committed and pushed. |
|
Documents the required Fine-Grained Personal Access Token scopes (specifically
Administration: Read-only) for theORG_SCORECARD_TOKENto resolve false-positive compliance audit issues regarding repository settings likedelete_branch_on_merge.Summary by CodeRabbit
Documentation
Bug Fixes