From 2bcfd55fac1ef0fdd3c42c802d96ba3e44126943 Mon Sep 17 00:00:00 2001
From: luckyPipewrench <gitlucky@pipelab.org>
Date: Fri, 14 Aug 2026 14:19:09 -0400
Subject: [PATCH] docs(scorecard): describe publish_results as OIDC
 verification

---
 .github/workflows/scorecard.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 1ef13b8..3f6c209 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -18,8 +18,8 @@ jobs:
       # No security-events: write. This job no longer uploads SARIF to code
       # scanning, so it needs no permission to write code-scanning alerts. It
       # does still upload results.sarif as a build artifact below. id-token
-      # remains because publish_results signs the result for the public
-      # Scorecard API.
+      # remains because publish_results uses GitHub's OIDC token to verify the
+      # result's authenticity when publishing it to the public Scorecard API.
       id-token: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7