It needs few additional permissions to work in private repos as mentioned here https://github.com/ossf/scorecard-action/issues/1248