Using the built-in GitHub token as default for the token input

[EndBug]

Hi, I just have a quick question/suggestion: I've seen that you set up your inputs so that the user has to create a PAT to use with the action.
Is there a reason why you don't use the built-in token as default, neither recommend doing so?

[azeemshaikh38]

This is due to a limitation in the default token to make GitHub API calls. Please see this comment and thread for more details - ossf/scorecard#1097 (comment)

[azeemshaikh38]

Note that we are still exploring the possibility (and would very much prefer) to use the default token instead of PAT. But if the limitation is too restrictive, users may need to continue using a PAT.

[EndBug]

Got it, thanks for the quick reply :)