Feature: Improve error message when branch protection check fails because of the use of GITHUB_TOKEN

[ashishkurmi]

Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] When the scorecard GitHub action is used for evaluation, the default GitHub Actions token lacks the necessary permissions to perform the branch protection check, resulting in the following generic access issue error: "Reasoning: internal error: error during brancheshandler.setup: internal error: githubv4.query: resource not accessible by integration"

Often times maintainers fail to understand the error message and end up ignoring the check all together.

Describe the solution you'd like A clear and concise description of what you want to happen. We can check if the branch protection check fails because of the use of GITHUB_TOKEN and provide a more helpful error message.

Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered.

Additional context Add any other context or screenshots about the feature request here. For example, NodeJS is using the Scorecard action to calculate their Scorecard scores which returns this generic error messsage: https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/nodejs/node "Reasoning: internal error: error during brancheshandler.setup: internal error: githubv4.query: resource not accessible by integration"

[ashishkurmi]

I will be happy to take up this task. @ossf/scorecard-maintainers: Could you please assign this task to me if you don't have any concerns?

[github-actions[bot]]

Stale issue message - this issue will be closed in 7 days

[spencerschrock]

With repo rules merged in #3354, this issue might want to push people towards that.

[github-actions[bot]]

This issue is stale because it has been open for 60 days with no activity.

[dcaine125]

Hey @spencerschrock, @jakbrownbytes and I would like to work on this issue if it is still not being worked on.

[jakbrownbytes]

After reviewing the issue, would it be more appropriate to implement a code change? If so, which file(s) would you recommend investigating? Or would it be preferable to address this through a documentation update to guide users before contributing?