From 04a39a4c9f6d6f46a577cee9addb61739db2f6c0 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 1 Jul 2026 22:37:19 +0100 Subject: [PATCH] fix(ci): align caller permissions with pinned reusables (secret-scanner, scorecards) Both workflows startup-failed on main from the same root cause class: caller-vs-reusable permissions drift. - Secret Scanner: the pinned reusable's gitleaks job requests pull-requests: write + actions: read at job level, but the caller granted only contents: read workflow-wide. Grant exactly those three on the scan job. - Scorecards: the caller's job-level permissions block (security-events + id-token) replaces the workflow-level read-all entirely, dropping contents: read that the reusable declares for checkout. Restate contents: read in the job block. Minimum-necessary grants only; no write-all. Co-Authored-By: Claude Fable 5 --- .github/workflows/scorecard.yml | 4 ++++ .github/workflows/secret-scanner.yml | 7 +++++++ 2 files changed, 11 insertions(+) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 80a3c07e..7176a146 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -12,8 +12,12 @@ permissions: read-all jobs: analysis: + # Job-level permissions REPLACE the workflow-level read-all block, so + # contents: read must be restated here — the reusable declares it + # (checkout needs it) and startup-fails if the caller doesn't grant it. permissions: security-events: write id-token: write + contents: read uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e # main 2026-05-28 (SPDX bump #249) secrets: inherit \ No newline at end of file diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index ecc37a42..701e1dc1 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -15,5 +15,12 @@ permissions: jobs: scan: + # The reusable's gitleaks job requests pull-requests: write (PR summary + # comment) and actions: read (workflow-run metadata) at job level; the + # caller must grant at least that or the run startup-fails. + permissions: + contents: read + pull-requests: write + actions: read uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 # main 2026-05-28 (SPDX bump #249 + pragma/.shell-secrets-ignore fix #236) secrets: inherit