Bug: scorecard-action is failing consistently starting with 2.0.0

[godofredoc]

Updating to 2.0.2 didn't fix the issue.

Generating ephemeral keys...
Retrieving signed certificate...

    Note that there may be personally identifiable information associated with this signed artifact.
    This may include the email address associated with the account with which you authenticate.
    This information will be used for signing this artifact and will be stored in public transparency logs and cannot be removed later.

Non-interactive mode detected, using device flow.
Enter the verification code CFFR-RKTZ in your browser at: https://oauth2.sigstore.dev/auth/device?user_code=CFFR-RKTZ
Code will be valid for 300 seconds
2022/09/09 15:45:40 error signing scorecard json results: error signing payload: getting key from Fulcio: retrieving cert: error obtaining token: expired_token

[azeemshaikh38]

Looking into it. v2.0.3 fixed it for other repos which were noticing similar errors, trying to debug why this did not fix it for Flutter

[godofredoc]

Thank you @azeemshaikh38 for the fix.

For context if anybody is hitting this issue you may be missing the id-token permission as in here: https://github.com/flutter/flutter/blob/master/.github/workflows/scorecards-analysis.yml#L22