Scorecards workflow failing with 500 Internal Server Error during signature processing

[italogabrielcs]

Hello,
Our GitHub Actions workflow using ossf/scorecard-action is failing with the following error:

2022/10/17 16:45:56 error processing signature: http response 500, status: 500 Internal Server Error,
error: {"code":500,"message":"something went wrong and we are looking into it."}

Workflow except

• name: Run analysis
  uses: ossf/scorecard-action@e363bfc
  with:
  results_file: results.sarif
  results_format: sarif
  repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}
  publish_results: true

GitHub Copilot
Claro! Segue um modelo de issue para abrir no repositório do ossf/scorecard:

Título:
Scorecards workflow failing with 500 Internal Server Error during signature processing

Descrição:
Hello,
Our GitHub Actions workflow using ossf/scorecard-action is failing with the following error:

2022/10/17 16:45:56 error processing signature: http response 500, status: 500 Internal Server Error,
error: {"code":500,"message":"something went wrong and we are looking into it."}
Workflow excerpt:

• name: Run analysis
  uses: ossf/scorecard-action@e363bfc
  with:
  results_file: results.sarif
  results_format: sarif
  repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}
  publish_results: true
  Additional info:

The error seems to be related to signature processing (possibly Sigstore/Fulcio/Rekor).
The workflow was working previously and started failing recently.
Retrying the workflow sometimes works, but the error is frequent.
Steps to reproduce:

Run the Scorecards workflow on our repository.
Observe the failure with HTTP 500 error.
Expected behavior:
The workflow should complete successfully and upload the results.

Actual behavior:
The workflow fails with a 500 Internal Server Error during signature processing.

Environment:

GitHub Actions
ossf/scorecard-action@e363bfc
Anything else to add:
Please let us know if you need more logs or details.

[spencerschrock]

2022/10/17 16:45:56 error processing signature

This error message is nearly 3 years old, is that right? If this is a public repository, can you share a link?