Scheduled run fails

[ben-manes]

I set up this action and the scheduled run failed with,

refs/heads/master not supported with 'schedule' event.
Only the default branch 'refs/heads/null' is supported

Since I followed your guide and did not modify this action, I think there is a missing step somewhere?

[godofredoc]

Here is an example from flutter failing because of the same reason.

[laurentsimon]

We fixed this in v1.0.3 https://github.com/ossf/scorecard-action/releases/tag/v1.0.3
If you've used the example workflow in the repo or the one from the GitHub UX tab, you're probably using an older version.

In the meanwhile, can you please use ossf/scorecard-action@b614d455ee90608b5e36e3299cd50d457eb37d5f , which is the hash for v1.0.3

Please confirm this works.

Let me update the documentation now.

[ben-manes]

In my case I did use v1.0.3 via a dependabot upgrade. Did the yaml file change between versions otherwise?

---

Bump ossf/scorecard-action from 1.0.2 to 1.0.3 (https://github.com/ben-manes/caffeine/pull/659)
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 1.0.2 to 1.0.3.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Commits](https://github.com/ossf/scorecard-action/compare/c8416b0b2bf627c349ca92fc8e3de51a64b005cf...b614d455ee90608b5e36e3299cd50d457eb37d5f)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

ben-manes/caffeine@30f3a05

[laurentsimon]

correct. I was checking your hash and you have the right one. Flutter has the old one.
Could you run these lines https://github.com/ossf/scorecard-action/blob/main/entrypoint.sh#L51-L54 and tell me what you get?

[laurentsimon]

I think I've found the issue: your run logs hasRepository: null. I don't understand why the env variable GITHUB_REPOSITORY (https://docs.github.com/en/actions/learn-github-actions/environment-variables) is not set for schedule trigger, that's strange. Let me see what I can do.

[ben-manes]

I created a new token using the same permissions you have in the readme, then ran it:

curl -s -H "Authorization: Bearer $GITHUB_AUTH_TOKEN" https://api.github.com/repos/ben-manes/caffeine > repo_info.json
ben: caffeine $ echo $SCORECARD_PRIVATE_REPOSITORY
false
ben: caffeine $ echo $SCORECARD_DEFAULT_BRANCH
refs/heads/master

[laurentsimon]

We used to take this variable from the json payload https://github.com/ossf/scorecard-action/pull/83/files, but it turns out schedule events don't have one, so I switched to the env variable GITHUB_REPOSITORY.. which seems empty as well.
Bear with me. I need to find a way to get the original repository name...

[ben-manes]

no worries, thank you!

[laurentsimon]

cc @ChrisCarini

[ScottBrenner]

Found this issue via a similar failure in https://github.com/ScottBrenner/cfn-lint-action/runs/5074749835?check_suite_focus=true#step:4:15.

why the env variable GITHUB_REPOSITORY (https://docs.github.com/en/actions/learn-github-actions/environment-variables) is not set for schedule trigger

From https://github.community/t/repository-name-in-environment-variable/16856/7:

The schedule event does not have an event payload

Reference https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#schedule

[laurentsimon]

Thank you. I expected the env variable to be set even though there's no event payload.. after all github.repository has nothing to do with the event payload, does it?

The ${{ github.repository }} is not directly accessible from an action, so I need to create an undocumented action argument to populate it. I'd like to avoid doing this, so I'll wait till I hear back from the GH support ticket I created. AFAICT, the GITHUB_REPOSITORY is not part of the payload event so it should be populated as per https://docs.github.com/en/actions/learn-github-actions/environment-variables

Thank you all for your help!